fix(api): Cache-Control + Vary on /api/v1/usage/wall

[mastermanas805]

Summary

• BUG-API-420: dashboard fetches /api/v1/usage/wall on every nav + 5-min poll; without a cache hint the browser re-fetches on every back/forward / SPA route change, generating redundant DB scans on the busy team-scoped audit_log table.
• Stamp Cache-Control: private, max-age=30 + Vary: Authorization on every 200 path.

Consistency tradeoff (memory rule feedback_caching_and_consistency_tradeoffs)

• Worker writes ≤1 near_quota_wall row per team per 24h (quotaWallDedupeWindow). 30s staleness window can miss a brand-new wall event by ≤30s — fine for a soft upgrade nudge.
• Hard 402 quota enforcement still fires synchronously on the next provision regardless of cached banner state.
• 30s << the 5-min dashboard poll interval, so walls become visible within 5min + 30s in the worst case.
• Vary: Authorization keys per-team caching to the bearer token so a shared CDN / browser back-cache after re-auth never serves team A's banner to team B.

Coverage block (rule 17)

Symptom:       /api/v1/usage/wall returns no Cache-Control hint
Enumeration:   GetWall has THREE distinct 200 code paths
               (team-tier short-circuit, no-recent-row,
               row-found-with-metadata).
Sites found:   3
Sites touched: 3 — one setUsageWallCacheHeaders call on each
Coverage test: TestUsageWall_CacheHeadersOnEvery200Path iterates
               the registry of 3 paths via a test table and asserts
               the same Cache-Control + Vary on every one — adding
               a 4th 200 path without the cache header fails the
               test (rule 18 registry-iterating pattern).
Live verified: pending CI auto-deploy (rule 14 SHA check after merge).

Test plan

• go build ./... clean
• go vet ./... clean
• go test ./internal/handlers -run TestUsageWall all pass
• setUsageWallCacheHeaders: 100% covered
• GetWall: 96.3% (uncovered: pre-existing db_failed branch outside diff)
• Live verify after merge: curl -i -H "Authorization: Bearer <pat>" https://api.instanode.dev/api/v1/usage/wall | grep -i 'cache-control\|^vary'

Inbox: BUG-API-420