Reduce JWT auth user lookup count

[jjoonleo]

Summary

• Remove the duplicate User lookup in the JWT protected-request authentication path by moving Active Session validation into AuthTokenService.validateActiveAccessToken(...).
• Reuse the validated User when saving Spring Security authentication.
• Add regression coverage for one authentication lookup and a protected-request SQL budget.
• Add a JWT auth benchmark harness and record quick before/after evidence in docs/performance/jwt-auth-325.md.

Benchmark Evidence

Quick benchmark mode, one 5-minute run per scenario, endpoint GET /users/me/punctuality-score:

scenario	before p95	after p95	SQL sample
c1	46.770ms	38.093ms	7 -> 5
c10	52.873ms	40.129ms	7 -> 5
c20	36.560ms	29.620ms	7 -> 5

Validation

• ./gradlew check
• scripts/benchmarks/jwt-auth/run.sh before quick against pre-fix worktree
• scripts/benchmarks/jwt-auth/run.sh after quick against this branch

Closes #325