fix(ocpp): auth cache spec compliance (R0–R17) (#1699)

fix(ocpp): auth cache spec compliance (R0–R17) (#1699)

* fix(ocpp): wire auth cache into strategies and fix default configuration

* fix(ocpp): add isCacheable dead code note and cache wiring test

* fix(ocpp): cache all authorization statuses per OCPP spec (R1)

- Remove ACCEPTED-only guard in RemoteAuthStrategy: now caches ALL
  authorization statuses (BLOCKED, EXPIRED, INVALID) per OCPP 1.6 §3.5.1
  and OCPP 2.0.1 AuthCacheCtrlr
- Simplify isCacheable() to always return true — all statuses cacheable
- Update AuthHelpers tests to reflect all-statuses policy (T4.05-T4.09)
- Add RemoteAuthStrategy tests for BLOCKED/EXPIRED/INVALID caching (T4.01-T4.04)

* fix(ocpp): status-aware eviction, TTL reset, expired lifecycle (R2, R5, R10, R16)

* fix(ocpp): exclude local auth list identifiers from cache (R17)

* fix(ocpp): periodic cache cleanup and bounded rate limits (R8, R9)

* fix(ocpp): make resetStats public and preserve stats across clear (R14, R15)

* test(ocpp): integration tests for auth cache spec compliance (T12)

* [autofix.ci] apply automated fixes

* fix(ocpp): address PR #1699 review feedback (F1-F9)

- F1: increment stats.hits for expired cache entries in get()
- F2: use captured 'now' timestamp in set() LRU update
- F3: two-phase expiration in runCleanup() (transition then delete)
- F4: guard cleanupIntervalSeconds with > 0 (NaN protection)
- F5: forward localAuthListManager to RemoteAuthStrategy
- F6: apply absolute 24h lifetime cap in expired-transition branch
- F7: guard local auth list query with config.localAuthListEnabled
- F8: mask identifier in debug logs (first 8 chars only)
- F9: remove dead isCacheable() method and its tests

* refactor(test): replace inline setTimeout with shared sleep helper

* [autofix.ci] apply automated fixes

* fix(ocpp): replace redundant Promise.resolve returns in async methods

* fix(auth): make AuthCache interface synchronous and remove all Promise wrappers

BREAKING CHANGE: AuthCache interface methods (get, set, remove, clear,
getStats) are now synchronous. OCPPAuthService.clearCache() and
invalidateCache() return void instead of Promise<void>.

- Remove async/Promise wrappers from AuthCache interface and InMemoryAuthCache
- Make OCPPAuthService clearCache/invalidateCache return void
- Update all strategies (Local/Remote) to use sync cache operations
- Remove await from all sync cache calls in source and test files
- Fix mock factories to use sync signatures with /* empty */ bodies
- Widen TTL timing margins in InMemoryAuthCache tests to reduce flakiness
- Fix JSDoc annotations in TestLifecycleHelpers and InMemoryAuthCache

* refactor(auth): eliminate all Promise.resolve() from auth module

Replace Promise.resolve() wrappers with proper sync/async signatures:
- Update AuthStrategy interface: getStats() returns sync Record, initialize() returns sync void
- Update OCPPAuthService interface: getStats() returns sync AuthStats
- Convert strategy getStats()/initialize()/cleanup() implementations to sync
- Convert adapter sync methods (convertToUnifiedIdentifier, convertFromUnifiedIdentifier,
  getConfigurationSchema, validateConfiguration) from async to sync
- Update OCPPAuthServiceImpl to match sync interface signatures
- Update OCPPAuthIntegrationTest to match sync interface
- Align all test mocks with exact interface signatures (sync mocks for sync
  interfaces, async mocks for async interfaces)
- Remove all eslint-disable require-await comments from test files

* fix(auth): resolve all lint errors for CI compliance

- Reorder union types to satisfy perfectionist/sort-union-types
- Remove @returns JSDoc from void functions (jsdoc/require-returns-check)
- Make OCPP16/20 adapter sync methods non-async (require-await)
- Fix all mock signatures to match interface contracts exactly
- Replace async mock lambdas with new Promise<T> pattern
- Fix no-confusing-void-expression in test assertions
- Sort named imports alphabetically (perfectionist/sort-named-imports)
- Add missing await for floating promise in test (no-floating-promises)

* [autofix.ci] apply automated fixes

* fix(auth): remove eslint-disable added by us, use expect().not.toThrow() pattern

* ci: trigger CI run

* refactor(auth): apply code review corrections (fixes 1-10)

Fix validators, convert static classes to modules,
improve cache configurability, fix test configs,
replace sleep with mock timers, fix Promise leak,
move integration test helper to tests/helpers.

* fix(auth): resolve all 35 JSDoc lint warnings for clean lint gate

* fix(auth): address cross-validated audit findings (C1-C3, M1-M6, minor fixes)

- C1: fix timer leak in performRemoteAuthorization (clearTimeout on success/catch)
- C2: document LocalAuthListManager stub with TODO, mark §3.5.3 guard inactive
- C3: expand factory gate to check all three auth feature flags
- M1: change RemoteAuthStrategy.canHandle to use remoteAuthorization config flag
- M2: add AuthenticationMethod.NONE enum for all-strategies-fail fallback
- M4: add NO_AUTHORIZATION to OCPP20AuthAdapter validTypes
- M3: wire hasExplicitTtl into CacheEntry for CSMS-provided TTL preservation
- M6: filter NoAuthorization/Central identifiers from cache (C02.FR.03, C03.FR.02)
- m3: fix boundRateLimitsMap to evict in loop until within threshold
- m4: stop counting expired entries as cache hits
- m7: clamp TTL to [0, maxAbsoluteLifetime] range
- m8: enforce maxEntries >= 1 in constructor

* refactor(auth): use sleep() utility instead of raw Promise setTimeout

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>