taiga-0001: taiga/events/middleware.py stores request X-Session-ID in threading.local,
leaking it across thread-pool requests when process_response is skipped.
Fix: replace with contextvars.ContextVar for proper per-request isolation.
redmine-0004: Role#add_permission! in app/models/role.rb calls permissions.include?(p)
(Array O(P)) inside a perms.each loop — O(P^2) total. At P=1000 permissions,
68.6x overhead measured. Fix: build a Set once before the loop, use Set#add?.
