fix(cabana): scope the token last_used_at throttle to the guard instance

- The process-global debounce map was keyed by token ID, so a stamp from one test database suppressed a later write in another and turned TestBackendTokenPostgres red depending on order
- Each compositeGuard now owns a stampThrottle; the backend guard and the ResolveBackend guard of one activation share it, so a single-app binary still writes last_used_at at most once a minute per token
- TestTokenLastUsedThrottlePerGuard pins the per-guard isolation

modules/cabana/http.go

@@ -171,6 +171,8 @@ func Activate(app *backpack.App, plugins []party.Plugin) (*Routes, error) {
 	if _, published := app.Lookup[*backendResolver](); !published {
 		cookieLessJWT := bouncer.NewBackendJWTGuard(secret, users, bl, writeUnauthenticated)
 		resolverGuard := newCompositeGuard(cookieLessJWT, store, users, reg)
+		// The admin middleware and ResolveBackend share one throttle per activation.
+		resolverGuard.stamps = guard.stamps
 		if err := app.Publish(&backendResolver{guard: resolverGuard}); err != nil {
 			return nil, fmt.Errorf("cabana: backend resolver: %w", err)
 		}