sr-ht-dolt-1nt Replace hand-rolled meta-PAT cache in authn/token.go with sr-ht-ecore/metapat Lined Up

What is wrong: `sourcehut-dolt/authn/token.go` (`ResolveBasic`, `tokenCacheMu`, `tokenCache`, `cacheGet`, `cachePut`, `tokenCacheTTL`, package-level `nowFn`) and `authn/bearer.go::ResolveBearer`/`::resolveMetaPAT` hand-roll a meta-PAT resolution plane instead of using `sr-ht-ecore/metapat`, even though dolt already imports ecore's `bearer`, `grants`, `login`, `csrf`, and `internalauth`. Both dolt's cache and metapat's cache on sha512 of the presented token for 60s and cache successes only, but dolt's cache is a package-level global with no size bound, where metapat's is per-Validator, has an injectable `Now`, and drops the map at `maxCacheEntries = 4096`. dolt does not route through `metapat.PlaneOf` and its `RepoScope = "dolt.sr.ht/repos"` check is inline rather than through `metapat.Allows`, so dolt does not inherit metapat's centrally-defined rules: "no grants ⇒ universal", "no BearerToken ⇒ pass", the ordering guarantee that local checks refuse before any network call, the sentinel set, and the `ErrRevoked → 401 not 403` rule.

Why it matters: an unbounded package-level global map in a long-running process is a slow leak (mitigated somewhat because `cachePut` only runs on successful resolves, so growth is bounded by distinct valid tokens rather than attacker input) — but the larger and more durable cost is duplicated authorization policy on the auth path, which will drift from the canonical implementation over time.

Sibling that already does it correctly: `sr-ht-ecore/metapat`, which exists precisely so five services do not each write this logic separately. dolt's credential does arrive differently — as an HTTP Basic password (dolt's remote protocol) rather than a bearer header — but that is just header parsing that can sit on top of `metapat.Resolve`.

Fix: reduce `authn/token.go` to header parsing + `metapat.Resolve` + `metapat.Allows`, behind dolt's existing `MetaValidator`-shaped port; delete the global cache. The sentinel-error mapping (e.g. revoked → 401) is the only genuinely new work.

Status: reported, not independently re-verified against `authn/token.go` in this register — found independently by two separate analysis passes (03-auth D4, 04-federation #4) plus a third pass (05-caching D14) that found the same unbounded cache from the caching angle. Reproduce/re-read `authn/token.go` before treating the size-bound claim as certain.

Audit: D11 (cross-repo audit, 2026-08-17)