perf(backend): fix top backend performance issues (P0)

[KillerX]

Address the four highest-impact findings from the backend performance review:

• Event.challenges N+1: add batched getVisibleEventChallenges (batch quiz session-access, enrollment, quiz loads and translations), mirroring the already-optimized project path. The event resolver now delegates to it; visibility semantics (incl. unauthenticated viewers) are preserved.
• Cache KeyRegistry leak: ristretto eviction callbacks only expose the hashed key, so wrap stored values to carry their string key and prune the registry on OnEvict/OnReject. Prevents unbounded registry growth and DeletePrefix slowdown over time. Adds a regression test.
• Push broadcast: use a shared HTTP client with a request timeout and a bounded worker pool so a stalled endpoint can't hang a broadcast and large fan-outs don't exhaust FDs/DB pool. Replace hand-rolled contains with strings.Contains.
• Maintenance SyncUserData: process users through a bounded concurrency pool instead of sequential Members API lookups, keeping the cron response contract unchanged.

Assisted by Claude Opus 4.8 via Claude Code