Summary

• Add PERMISSION_AUDIT_ENABLED environment variable (default false) to control whether RBAC permission checks are written to the permission_audit_log table
• Make PermissionService.__init__ default to settings.permission_audit_enabled instead of always-on auditing, preventing unnecessary DB writes under load
• Cache roles in _roles_cache during get_user_permissions() so _get_roles_for_audit() reuses them synchronously instead of issuing a duplicate DB query
• Use contains_eager + result.unique() in _get_user_roles to avoid N+1 queries when eager-loading the Role relationship
• Update .env.example, Helm values.yaml/values.schema.json, and configuration docs

Test plan

• Verify PERMISSION_AUDIT_ENABLED=false (default) produces no rows in permission_audit_log
• Verify PERMISSION_AUDIT_ENABLED=true writes audit rows for each permission check
• Run tests/unit/mcpgateway/services/test_permission_service_comprehensive.py