fix: concurrent stale race, Redis expire leak, missing invalidation, UI Suspense

- Fix integration data cache: set pending synchronously before creating
  fetch to prevent concurrent stale-revalidation from spawning duplicate
  upstream calls
- Redis cache handler: skip persisting entries with expire=0 (dynamic
  entries should not be stored in Redis)
- Add missing invalidation: user.changePassword, group.updateGroup,
  group.transferOwnership
- Move SearchEngineOptimization inside Suspense in root layout
- Add Suspense fallback loader to root layout
- Move searchParams resolution inside Suspense in login page

packages/api/src/router/group.ts

@@ -232,6 +232,14 @@ export const groupRouter = createTRPCRouter({
           name: input.name,
         })
         .where(eq(groups.id, input.id));
+
+      const members = await ctx.db.query.groupMembers.findMany({
+        columns: { userId: true },
+        where: eq(groupMembers.groupId, input.id),
+      });
+      for (const member of members) {
+        invalidateUserCache(member.userId);
+      }
     }),
   savePartialSettings: permissionRequiredProcedure
     .requiresPermission("admin")
@@ -325,6 +333,7 @@ export const groupRouter = createTRPCRouter({
           ownerId: input.userId,
         })
         .where(eq(groups.id, input.groupId));
+      invalidateUserCache(input.userId);
     }),
   deleteGroup: permissionRequiredProcedure
     .requiresPermission("admin")