[Performance] Batch reauthorize persisted post-Ask evidence without N+1 queries #358

Buyer impact

Reading a post with many persisted Ask exchanges currently reauthorizes each exchange serially. Correctness and fail-closed behavior are preserved, but database round-trips grow linearly with exchange count and can make the post detail visibly slower.

Current authority boundary

• Keep current tenant ABAC, publication eligibility, and each exchange's persisted knowledge cutoff.
• If any citation for an exchange is no longer visible, withhold that exchange exactly as today.
• Do not reuse stale authorization or expose hidden citation labels, counts, project links, or prose.
• Do not replace the canonical Project-history API or TEPP adapter.

Required implementation

1. Add a bounded repository function that accepts all persisted exchange citation sets and cutoffs for one post.
2. Validate citation UUIDs before SQL.
3. Fetch the authorized citation/project evidence in one bounded query or a fixed small number of queries.
4. Partition the result back to each exchange deterministically.
5. Preserve current response ordering and fail-closed removal semantics.
6. Add a maximum exchange/citation budget and explicit truncation or typed failure rather than an unbounded IN list.
7. Record query-count and latency evidence in docs/product-technical-gap-baseline.md.

TDD acceptance

• 1, 10, and maximum supported exchange histories produce identical authorized responses to the current implementation;
• a hidden citation removes only the affected exchange and leaks no title, count, project key, or answer text;
• mixed knowledge cutoffs cannot admit evidence newer than each exchange's own cutoff;
• query count remains bounded independently of exchange count;
• real PostgreSQL integration, tenant isolation, statement/branch coverage, docstrings, and full API regressions pass;
• no feature or Buyer evidence surface is removed.

Origin

Tracked from the exact-head review of PR #342. The current implementation remains correct; this issue owns the bounded performance improvement so the security repair is not diluted by an unrelated query refactor.