Enforcer usage patterns (reads vs writes)

Description

The sync enforcer is currently used for both read operations (permission checks) and write operations (policy changes). This may introduce unnecessary overhead during high-volume reads, but we do not have a clear separation between the two paths.

This issue tracks:

• Reviewing where and how the enforcer is used in read paths and write paths.
• Determining whether separating these paths would improve performance or reduce overhead. This is only a theory, we'd have to go deep into casbin to understand whether this would actually have an impact.

Trace the sync enforcer's read and write call sites across the repository, since the issue names no specific files or tests. First map permission checks versus policy changes, then determine whether separating the paths measurably reduces overhead and document the conclusion.