[xO-ox-ai]

Repeatedly opening encrypted folders downloads the E2EE server public key on every entry. The server-key endpoint's default limit of six requests per ten minutes can therefore block normal folder browsing with HTTP 429.

Share successful, non-empty server public key responses in an in-memory cache for ten minutes, using a monotonic clock and synchronizing concurrent requests. Cache entries are scoped to the complete server URL and freshly fetched user certificate, so certificate changes trigger a new download. Failed and empty responses are not cached. User certificates are still fetched and verified on every check; folder metadata and signature validation remain unchanged. Resolve clients through ClientRepository and adapt the existing encrypted-folder integration test setup to the injected dependencies.

Validation on this branch:

• Seven JVM tests passed, covering repeated entry, expiration, certificate changes, server/port isolation, failed/empty responses, concurrent requests, and certificate verification across inspector instances.
• Kotlin formatting and Detekt for the changed files passed.
• lintGplayDebug passed with no errors or warnings.
• Android instrumented test Kotlin sources compiled successfully.
• SpotBugs analysis of the changed production classes completed without analysis errors or missing classes; comparison with the base version found no new report identities.

AI disclosure: Codex (GPT-6) assisted with implementation, tests and analysis.