HttpGateway::attested_contracts should expire unused tokens to avoid a memory leak

[sanity]

After we merge the fix-delegate-auth branch, the HttpGateway::attested_contracts HashMap doesn't currently remove old tokens which will lead to a (very slow) memory leak.

One way to do this would be to use a crate like mini-moka to replace the Arc<RwLock<HashMap>> used currently.

[sanity]

🤖 Relabeled for consistency

Applied labels:

• T-bug
• P-medium
• E-medium
• A-contracts
• A-developer-xp

Reasoning: The issue describes an unbounded accumulation of attested tokens in HttpGateway::attested_contracts, which is a memory leak (bug). It appears to be a slow leak rather than release-blocking, so medium priority is appropriate. Replacing the Arc<RwLock<HashMap>> with a TTL/evicting cache (e.g., mini-moka) is a straightforward but non-trivial code change and dependency addition, so effort is medium. The problem relates to the HTTP gateway's contract/auth token handling (contracts area) and touches internal data-structure/implementation details (developer experience).

Previous labels: ``