fix: add probabilistic cleanup to token blacklist

The blacklist table grew indefinitely since cleanup only ran on
password changes and user deletions. Now each blacklist_token()
call has a 2% chance of triggering blacklist_expired() to prune
expired entries. Redundant cleanup calls in update_password()
and delete_user() are removed.

lib/auth.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 import base64
 import json
 import logging
+import random
 import secrets
 import time
 import uuid
@@ -322,6 +323,8 @@ def blacklist_token(jti: str, token_type: str = "access") -> None:
     db = get_db()
     ttl = get_refresh_ttl() if token_type == "refresh" else get_access_ttl()
     db.run(Q_INSERT_BLACKLIST, (jti, token_type, int(time.time()) + ttl))
+    if random.random() < 0.02:
+        blacklist_expired()
 
 
 def is_blacklisted(jti: str) -> bool: