Granular cache duration hierarchy

[benidk]

Description

Folowing this issue

Adds a hierarchical resolution mechanism for the web-approval caching window (the "remember this browser approval for N minutes" setting), so it can be tuned per security profile instead of only globally.

Previously web_approval_grace_period_seconds was a single global Parameters setting. This adds the same field to User and Role, and resolves it in priority order:

1. User override — wins outright if set.
2. Role override — otherwise, the shortest grace period among the user's currently active roles (expired/revoked assignments don't count). Taking the shortest is deliberately conservative: a stricter role's setting can't be loosened by also holding a looser one.
3. Global default — used when neither the user nor any of their roles set an override.

At every level, unset (null) means "inherit from the next level down"; an explicit 0 means "disable caching at this level" and does not fall through further.

This lets admins give e.g. contractors a short/no caching window via their role while internal engineers keep the longer global default, with individual users still overridable on top.

AI Usage

Choose the level of AI involvement for this PR.

• Fully vibe coded
• AI-designed, AI-coded, manually checked
• Human-designed, AI-coded
• Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

_{This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).}