fix(registry): invalidate public list cache on registry item writes

[pedrofrxncx]

Bug: apps/mesh/src/api/routes/registry/public-mcp-server.ts caches COLLECTION_REGISTRY_APP_LIST results in a module-level publicListCache with a 1-hour TTL, keyed by ${orgId}:${JSON.stringify(query)}. Nothing ever invalidated this cache. REGISTRY_ITEM_CREATE, REGISTRY_ITEM_UPDATE, REGISTRY_ITEM_DELETE, and REGISTRY_ITEM_BULK_CREATE all write straight to storage and return, with no call to clear the cache.

Failure scenario: an org admin deletes a registry item (e.g. a broken or malicious MCP server) or flips is_public off on an item — the unauthenticated public listing endpoint (used to browse/install MCP servers from the store) keeps serving the stale cached page for up to 60 minutes afterward, to any anonymous caller.

Fix: export invalidatePublicRegistryListCache() from public-mcp-server.ts (thin wrapper over the cache's already-tested .clear()) and call it from the four mutating tool handlers after a successful write.

Verify: cd apps/mesh && bunx tsc --noEmit (clean). The underlying clear() primitive is already covered by apps/mesh/src/lib/ttl-lru-cache.test.ts ("clear removes all entries"); this change is straight-line wiring with no new branches, so no new unit test was added — full CI covers the rest.

Net change: +19/-0, one concern (cache invalidation on write), four call sites.

---

Summary by cubic

Invalidate the public MCP server list cache after any registry item write to prevent stale results on the public listing. Public changes now appear immediately instead of after up to 60 minutes.

• Bug Fixes
  • Added invalidatePublicRegistryListCache() to clear the module-level public list cache.
  • Call it after successful create, update, delete, and bulk-create so deletions and privacy changes reflect instantly for anonymous users.

^{Written for commit 3535f30. Summary will update on new commits.}