feat: add a cronjob and its documentation

Author: HeloiseJoffe

docs/admin/how-to/install/installing.md

@@ -363,3 +363,11 @@ helm install --timeout 3600s <release-name> ./diracx-charts/diracx/ -f my_values
 !!! success "Congrats, you have installed DiracX"
 
     However, it does not do anything so far... See the [following steps](register-the-admin-vo.md)
+
+## AuthDB Cleanup CronJob
+
+Expired refresh tokens and device flows will accumulate in the AuthDB over time.
+This CronJob must be deployed to periodically remove them on the 1st of every month:
+```bash
+kubectl apply -f ./diracx-charts/k3s/manifests/cleanup-authdb-cronjob.yaml
+```

k3s/README.md

@@ -263,6 +263,14 @@ git add default.yml
 git commit -m 'Initial config'
 ```
 
+## AuthDB Cleanup CronJob
+
+Expired refresh tokens and device flows will accumulate in the AuthDB over time.
+This CronJob must be deployed to periodically remove them on the 1st of every month:
+```bash
+kubectl apply -f ./manifest/cleanup-authdb-cronjob.yaml
+```
+
 ## Post-install tips
 
 In case you would like to make us of the services installed (e.g. MySQL or OpenSearch) from outisde the kubernetes cluster, there are different solutions and configurations to make. LoadBalancer, NodePort, or Ingress are the options. One of these would need to be set out.

k3s/manifest/cleanup-authdb-cronjob.yaml

@@ -0,0 +1,60 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: diracx-cleanup-authdb
+  namespace: diracx
+spec:
+  schedule: "0 0 1 * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: cleanup
+              image: ghcr.io/diracgrid/diracx/services:dev
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  /opt/conda/bin/python -c "
+                  import asyncio
+                  import os
+                  from diracx.core.settings import AuthSettings
+                  from diracx.db.sql import AuthDB
+                  from diracx.logic.auth.token import cleanup_expired_data
+                  import logging
+
+                  logging.basicConfig(
+                    level=logging.INFO
+                  )
+
+                  async def main():
+                    db_url = os.getenv('DIRACX_DB_URL_AUTHDB')
+                    settings = AuthSettings()
+                    db = AuthDB(db_url)
+
+                    async with db.engine_context():
+                      async with db:
+                        await cleanup_expired_data(db, settings)
+
+                  asyncio.run(main())
+                  "
+              envFrom:
+                - secretRef:
+                    name: diracx-secrets
+                - secretRef:
+                    name: diracx-sql-connection-urls
+                - secretRef:
+                    name: diracx-dynamic-secrets
+              volumeMounts:
+                - name: keystore
+                  mountPath: /keystore/jwks.json
+                  subPath: jwks.json
+          volumes:
+            - name: keystore
+              secret: 
+                secretName: diracx-jwks
+                items:
+                  - key: jwks.json
+                    path: jwks.json