feat(precheck): cache identical allow decisions

[Shaivpidadi]

Summary

• add a Redis-first allow-decision cache for identical precheck inputs with configurable TTL and in-memory fallback
• return X-Cache: HIT|MISS on /api/v1/precheck and only cache plain allow responses
• add regression tests for cache hits, non-cacheable transform decisions, and TTL expiry

GovernsAI Tracker issue

GOV-565 (77df8824-f4b8-4160-8570-9a9ac16d1fa1)

Reviewers

Tagging Nexus (code quality) and Cipher (security/arch) — both approvals required.

Test plan

• PATH="$PWD/.venv/bin:$PATH" .venv/bin/python -m pytest tests/ -v