perf(grpc): O(1) unconstrained bulk fast path, direct filtered-command build, cache eviction, capacity hints

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/ConstraintEnforcer.cs

@@ -16,6 +16,14 @@ public sealed class ConstraintEnforcer(
     IGalaxyHierarchyCache cache,
     IAuditWriter auditWriter) : IConstraintEnforcer
 {
+    /// <inheritdoc />
+    public bool HasReadConstraints(ApiKeyIdentity? identity) =>
+        identity?.EffectiveConstraints.HasReadConstraints ?? false;
+
+    /// <inheritdoc />
+    public bool HasWriteConstraints(ApiKeyIdentity? identity) =>
+        identity?.EffectiveConstraints.HasWriteConstraints ?? false;
+
     /// <inheritdoc />
     public Task<ConstraintFailure?> CheckReadTagAsync(
         ApiKeyIdentity? identity,
@@ -211,7 +219,25 @@ public sealed class ConstraintEnforcer(
             return true;
         }
 
-        return subtreeGlobs.Any(glob => GalaxyGlobMatcher.IsMatch(containedPath, glob))
-            || tagGlobs.Any(glob => GalaxyGlobMatcher.IsMatch(tagAddress, glob));
+        // Plain index loops rather than Any(lambda): this runs once per item of every bulk
+        // read/write, and the closures the lambdas capture (containedPath / tagAddress) allocate a
+        // display class plus a delegate per call. Same short-circuit order, same result.
+        for (int i = 0; i < subtreeGlobs.Count; i++)
+        {
+            if (GalaxyGlobMatcher.IsMatch(containedPath, subtreeGlobs[i]))
+            {
+                return true;
+            }
+        }
+
+        for (int i = 0; i < tagGlobs.Count; i++)
+        {
+            if (GalaxyGlobMatcher.IsMatch(tagAddress, tagGlobs[i]))
+            {
+                return true;
+            }
+        }
+
+        return false;
     }
 }