fix: flush ristretto buffer before cache.Del to prevent async Set race

Ristretto's Set operations are buffered asynchronously. If a prior
request's SetWithTTL is still in the buffer when Del runs, Del finds
nothing to remove, and the buffered Set then re-adds the entry —
causing the old key to remain valid.

Adding cache.Wait() before cache.Del() flushes all pending buffered
operations first, ensuring the subsequent Del actually removes the
cached entry.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: AchoArnold

api/pkg/repositories/gorm_user_repository.go

@@ -84,6 +84,10 @@ func (repository *gormUserRepository) RotateAPIKey(ctx context.Context, userID e
 	}
 
 	if err == nil && oldAPIKey != "" {
+		// Wait() flushes any pending buffered Set operations in ristretto
+		// before Del, preventing a race where a prior request's async Set
+		// re-adds the key after our Del removes it from the store.
+		repository.cache.Wait()
 		repository.cache.Del(oldAPIKey)
 	}