perf(platform): index approved OAuth assets by content tuple (#556)

## Issue

OAuth upload validation currently scans every approved asset for each
requested asset while holding the project lock. At the allowed
5,000-asset batch size, this can require millions of comparisons.

## Fix

This reduces validation from O(approved × requested) to expected
O(approved + requested).

Build a `Set` of approved `(blake3, md5, size)` tuples, using a local
`assetApprovalKey()` helper with `JSON.stringify` for both indexing and
lookup. Project matching and exact matching of all three fields are
preserved.

## Benchmark results

12 paired runs on Apple M2 Pro, Node v24.21.0. Validation timings
include Set construction and JSON encoding; database, presigning, and
network I/O are excluded.

| Approved assets | Requested assets | Before | After | % reduction |
| --- | --- | --- | --- | --- |
| 100 | 100 | 0.084 ms | 0.051 ms | 39.1% |
| 5,000 | 100 | 4.721 ms | 2.082 ms | 55.9% |
| 5,000 | 1,000 | 40.969 ms | 2.317 ms | 94.3% |
| 5,000 | 5,000 | **227.016 ms** | **3.340 ms** | **98.5%** |
| 20,000 | 5,000 | 808.418 ms | 10.352 ms | 98.7% |

The 5,000/5,000 case is about **68× faster**.

## Why the tests changed

Expanded coverage verifies multiple approved assets, reordered batches,
duplicates, mismatched fields, mixed valid/invalid batches, and strict
field types (`"3"` versus `3`). **All 19 tests pass against both the
original and optimized implementations.**

## Verification

Typechecking passed; 4,447 affected tests and 14,496 full-suite tests
passed.

Author: yangshun

platform/packages/api/src/routes/deploy.ts

@@ -163,18 +163,19 @@ app.post('/:id/deploy/upload-urls', async (context) => {
           context.get('companyIdentity'),
           true,
         );
-        const approved = Object.values(approval.data.artifact!.assetManifest);
+        // JSON preserves tuple boundaries and field types, including malformed
+        // approval metadata that must not match a valid upload through coercion.
+        function assetApprovalKey(
+          asset: Pick<UploadUrlsRequestAsset, 'blake3' | 'md5' | 'size'>,
+        ): string {
+          return JSON.stringify([asset.blake3, asset.md5, asset.size]);
+        }
+        const approved = new Set(
+          Object.values(approval.data.artifact!.assetManifest).map(assetApprovalKey),
+        );
         if (
           approval.data.projectId !== projectId ||
-          assets.some(
-            (asset) =>
-              !approved.some(
-                (entry) =>
-                  entry.blake3 === asset.blake3 &&
-                  entry.md5 === asset.md5 &&
-                  entry.size === asset.size,
-              ),
-          )
+          assets.some((asset) => !approved.has(assetApprovalKey(asset)))
         ) {
           throw new OAuthError(
             'access_denied',

platform/packages/api/test/integration/oauth.test.ts

@@ -208,9 +208,24 @@ describe('registered OAuth applications', () => {
       size: 3,
       contentType: 'text/javascript',
     };
+    const otherAsset = {
+      ...asset,
+      blake3: computeAssetHash(new TextEncoder().encode('page').buffer, '/page.js'),
+      md5: 'b'.repeat(32),
+      size: 4,
+    };
     const prepared = createDeployArtifact({
       ...artifact,
-      assetManifest: { '/app.js': { ...asset, hash: asset.blake3 } },
+      assetManifest: {
+        '/app.js': { ...asset, hash: asset.blake3 },
+        '/page.js': { ...otherAsset, hash: otherAsset.blake3 },
+        '/wrong-type.js': {
+          ...asset,
+          blake3: 'd'.repeat(32),
+          hash: 'd'.repeat(32),
+          size: '3' as unknown as number,
+        },
+      },
     });
     const issued = await request('/oauth/preview-deployment-requests', {
       method: 'POST',
@@ -222,15 +237,19 @@ describe('registered OAuth applications', () => {
       }),
     });
     const receipt = (await issued.json()) as { access_token: string; approval_id: string };
-    const upload = (entry: typeof asset) =>
+    const upload = (...assets: Array<typeof asset>) =>
       request('/projects/' + project.project_id + '/deploy/upload-urls', {
         method: 'POST',
         headers: { ...headers, Authorization: 'Bearer ' + receipt.access_token },
-        body: JSON.stringify({ assets: [entry] }),
+        body: JSON.stringify({ assets }),
       });
     expect((await upload(asset)).status).toBe(200);
+    expect((await upload(otherAsset, asset, asset)).status).toBe(200);
     expect((await upload({ ...asset, size: 4 })).status).toBe(403);
+    expect((await upload({ ...asset, md5: 'b'.repeat(32) })).status).toBe(403);
     expect((await upload({ ...asset, blake3: 'c'.repeat(32) })).status).toBe(403);
+    expect((await upload(otherAsset, { ...asset, size: 4 })).status).toBe(403);
+    expect((await upload({ ...asset, blake3: 'd'.repeat(32) })).status).toBe(403);
     const [record] = await env.db
       .select()
       .from(oauthRequests)