feat: add PermissionLruCache (128-entry LRU) and wire into ClientPermissions

tests/NATS.Server.Tests/PermissionLruCacheTests.cs

@@ -0,0 +1,52 @@
+using NATS.Server.Auth;
+
+namespace NATS.Server.Tests;
+
+public class PermissionLruCacheTests
+{
+    [Fact]
+    public void Get_returns_none_for_unknown_key()
+    {
+        var cache = new PermissionLruCache(128);
+        cache.TryGet("foo", out _).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Set_and_get_returns_value()
+    {
+        var cache = new PermissionLruCache(128);
+        cache.Set("foo", true);
+        cache.TryGet("foo", out var v).ShouldBeTrue();
+        v.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Evicts_oldest_when_full()
+    {
+        var cache = new PermissionLruCache(3);
+        cache.Set("a", true);
+        cache.Set("b", true);
+        cache.Set("c", true);
+        cache.Set("d", true); // evicts "a"
+
+        cache.TryGet("a", out _).ShouldBeFalse();
+        cache.TryGet("b", out _).ShouldBeTrue();
+        cache.TryGet("d", out _).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Get_promotes_to_front()
+    {
+        var cache = new PermissionLruCache(3);
+        cache.Set("a", true);
+        cache.Set("b", true);
+        cache.Set("c", true);
+
+        // Access "a" to promote it
+        cache.TryGet("a", out _);
+
+        cache.Set("d", true); // should evict "b" (oldest untouched)
+        cache.TryGet("a", out _).ShouldBeTrue();
+        cache.TryGet("b", out _).ShouldBeFalse();
+    }
+}