Fix cache invalidation bug for Forge key scope updates

[Dokujaa]

Problem

Fixes issue #8 where newly added providers were not immediately reflected in Forge key permissions. Users had to wait for the 5-minute cache expiry before seeing updated provider lists.

Root Cause

Cache key format mismatch between cache setting and invalidation operations:

• Cache setting (get_user_by_api_key): uses stripped key format forge_scope:abc123
• Cache invalidation: was using full key format forge_scope:forge-abc123

This resulted in cache invalidation calls targeting non-existent cache entries.

Solution

• Fix cache key format consistency in invalidate_forge_scope_cache() and async variant
• Strip "forge-" prefix during invalidation to match cache setting format
• Add cache invalidation calls to API routes for scope updates, key deletion, and regeneration
• Include comprehensive unit tests covering edge cases and async functionality

All the tests I ran passed, let me know if there are issues still.

Fixes #8

[lingtonglu]

Looks good to me. Cloned to my local and validate that it's working correctly. Good work 👍

[wilsonccccc]

Thanks for the contribution — it's a solid fix. Especially appreciate catching the bug where the cache key was missing the "forge-" prefix. This issue originated from [this line](

forge/app/api/dependencies.py

Line 161 in c2030af

api_key = api_key_from_header[6:]

), where we had previously removed the checksum logic during the process of open-sourcing the repo. That original checksum logic calculated the hash using just the key value (without the "forge-" prefix) to reduce the risk of hash collisions.