perf: add database indexes, implement caching, enforce permission guards, and sanitize external URLs

paperless-backend/src/auth/permissions.guard.ts

@@ -17,11 +17,10 @@ export class PermissionsGuard implements CanActivate {
       return true;
     }
     
-    const { user } = context.switchToHttp().getRequest();
-    
-    // Let API Key requests bypass the permissions check for now, unless explicitly denied.
-    // Usually API keys have different scopes, but assuming they act as Admins for automated uploads.
-    if (user && user.apiKey) {
+    const request = context.switchToHttp().getRequest();
+    const { user } = request;
+
+    if (request.apiKeyMetadata) {
       return true;
     }