feat(pchronicle): hot reload catalog authorization

[lizhicui]

Summary

• reload Catalog users and grants every 3 seconds without restarting pChronicle; dataset and backend storage configuration changes still require a restart
• use one ACL snapshot per request and retain the last valid configuration when a reload fails
• keep public browsing consistent with the request's authorization snapshot

Validation

• targeted Catalog and worker tests passed (38 passed)
• CLI regression run: 387 passed, with 4 service-readiness timeouts; all 4 passed on serial reruns
• cargo fmt -p persisting-pchronicle-cli --check and git diff --check passed