chore(reliability): recover() in fire-and-forget goroutines (closes #672)

Add deferred recover() to the three unprotected background goroutines
surfaced in the #669/#670 sibling audit:

- internal/auth/service_apikeys.go: UpdateLastUsed async goroutine
- internal/api/db_rate_limiter.go: cleanup async goroutine
- internal/api/handler_accounts.go: GCP ts.Token() goroutine; panic
  now also sends an error back on tokenChan so the caller returns
  promptly rather than blocking until the 15s deadline fires

Matches the existing pattern in ri_utilization_cache.go and scheduler.go.

Author: cristim

internal/api/db_rate_limiter.go

@@ -169,6 +169,11 @@ func (rl *DBRateLimiter) maybeCleanup() {
 	// Run cleanup in background
 	go func() {
 		defer rl.cleanupRunning.Store(false)
+		defer func() {
+			if r := recover(); r != nil {
+				logging.Warnf("db_rate_limiter: cleanup goroutine panic: %v", r)
+			}
+		}()
 		rl.cleanup()
 	}()
 }

internal/api/handler_accounts.go

@@ -881,6 +881,12 @@ func gcpTokenExchangeAttempt(ctx context.Context, ts oauth2.TokenSource) (Accoun
 	defer cancel()
 	tokenChan := make(chan tokenResult, 1)
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				logging.Warnf("handler_accounts: gcp token-exchange goroutine panic: %v", r)
+				tokenChan <- tokenResult{err: fmt.Errorf("token exchange panic: %v", r)}
+			}
+		}()
 		tok, err := ts.Token()
 		tokenChan <- tokenResult{tok: tok, err: err}
 	}()

internal/auth/service_apikeys.go

@@ -291,6 +291,11 @@ func (s *Service) ValidateUserAPIKey(ctx context.Context, apiKey string) (*UserA
 	keyID := key.ID
 	go func() {
 		if _, sfErr, _ := s.lastUsedSFG.Do(keyID, func() (any, error) {
+			defer func() {
+				if r := recover(); r != nil {
+					logging.Warnf("service_apikeys: UpdateLastUsed goroutine panic: %v", r)
+				}
+			}()
 			updateCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			defer cancel()
 			if err := s.UpdateLastUsed(updateCtx, keyID); err != nil {