fix: bump agent cache when custom role changes

Editing or deleting a custom role left warm IDB caches showing stale
embedded role details and permissions in the agent list, since the
account_user cache key only tracked custom_role_id on the account user.
Bump the account_user cache key from the custom role lifecycle so clients
refetch the agent list. The destroy bump is needed because dependent:
nullify updates account_users via update_all and skips their callbacks.

enterprise/app/models/custom_role.rb

@@ -39,4 +39,11 @@ class CustomRole < ApplicationRecord
 
   validates :name, presence: true
   validates :permissions, inclusion: { in: PERMISSIONS }
+
+  # CustomRole details are embedded into the cached account_user payload via
+  # api/v1/models/_account_user.json.jbuilder, so bump that cache key on any
+  # change. `dependent: :nullify` updates account_users via update_all (which
+  # skips their callbacks), so the deletion is bumped here directly.
+  after_update_commit -> { account.update_cache_key('account_user') }
+  after_destroy_commit -> { account.update_cache_key('account_user') }
 end

spec/enterprise/models/custom_role_spec.rb

@@ -9,4 +9,19 @@ RSpec.describe CustomRole, type: :model do
   describe 'validations' do
     it { is_expected.to validate_presence_of(:name) }
   end
+
+  describe 'account_user cache invalidation' do
+    let(:custom_role) { create(:custom_role) }
+
+    it 'bumps the account_user cache key after update' do
+      expect(custom_role.account).to receive(:update_cache_key).with('account_user')
+      custom_role.update(name: 'New Name')
+    end
+
+    it 'bumps the account_user cache key after destroy' do
+      custom_role
+      expect(custom_role.account).to receive(:update_cache_key).with('account_user')
+      custom_role.destroy
+    end
+  end
 end