Fix order-dependent transform permissions in tests - #81404

A handful of independent, low-risk fixes bundled together — each too small to
ship on its own, each a behavior improvement that also closes a minor
hardening gap.

Reduce DB load / avoid unconditional work:
- Settings cache: a settings-last-updated cookie now triggers a cheap
  single-row staleness check and reloads only if the cache is genuinely
  behind, instead of unconditionally reloading the whole settings table.
  Exposes restore-cache-if-needed! with a :force-check? option as the shared
  "reload if actually stale" primitive the cookie path now uses.

Reduce log noise:
- CORS origin validation runs on every request's raw Origin header, so it now
  parses that client-supplied value with the silent try-parse-url rather than
  the variant that logs "Invalid URL" at ERROR — a malformed Origin no longer
  fills the operator's error log. Parsing behavior is otherwise identical, so
  no CORS allow/deny decision changes.

Correctness (case-insensitivity):
- forgot_password throttles on the lower-cased email, matching the
  case-insensitive account lookup, so User@x and user@x share one bucket
  rather than each getting a fresh allowance.

Add a missing throttle:
- PUT /api/user/:id/password throttles the old_password re-auth check, which
  previously had none, bringing it in line with the other credential
  endpoints.

…ransform-403