feat: cache merged /facts and /nodes in memory, stale on backend failure

## Why
A busy Puppetboard re-fans-out the same /facts query every few seconds, and a
502 is worse than 30-second-old facts when every PuppetDB is unreachable.

## How
- Add a `Cache` interface (get reports fresh/stale/miss, put, stats) keyed on
  `<path>?<params>` with keys and repeated values sorted, plus a no-op default
  so uncached paths behave exactly as before.
- Route serveMerged/serveUnion/serveSummed through `serveCached`, so the
  reports cache drops in at `cacheFor` without touching a handler.
- Back /facts and /nodes with a byte-bounded LRU: `facts_ttl` (default 30s,
  clamped to a 30s cap) and `facts_cache_bytes` (default 64 MiB); expired
  entries are kept and served only when every backend fails.
- Single-flight identical keys so N concurrent requests cause one fan-out.
- Surface `cache` state and `serving_stale` in /healthz and the cache settings
  in `config show`.

config.go

@@ -25,6 +25,13 @@ const (
 
 	defaultTimeout      = 10 * time.Second
 	defaultFreshnessTTL = 30 * time.Second
+
+	// maxFactsTTL is a hard cap, not a default: a larger configured value is
+	// clamped down to it rather than rejected, so a stray env var cannot make a
+	// container crash-loop.
+	maxFactsTTL      = 30 * time.Second
+	defaultFactsTTL  = 30 * time.Second
+	defaultCacheSize = int64(64 << 20)
 )
 
 var exampleBackends = []Backend{
@@ -43,8 +50,11 @@ type Config struct {
 	Merge        string        `yaml:"merge"`
 	Timeout      time.Duration `yaml:"timeout"`
 	FreshnessTTL time.Duration `yaml:"freshness_ttl"`
+	FactsTTL     time.Duration `yaml:"facts_ttl"`         // 0 disables the /facts+/nodes cache
+	CacheBytes   int64         `yaml:"facts_cache_bytes"` // byte budget for that cache
 
-	sourcePath string // file this config was read from, empty if none was found
+	sourcePath      string        // file this config was read from, empty if none was found
+	factsTTLClamped time.Duration // pre-clamp facts_ttl, zero when nothing was clamped
 }
 
 // SourcePath returns the config file Load read, or "" when none was loaded.
@@ -61,6 +71,8 @@ func DefaultConfig() Config {
 		Merge:        mergeFreshness,
 		Timeout:      defaultTimeout,
 		FreshnessTTL: defaultFreshnessTTL,
+		FactsTTL:     defaultFactsTTL,
+		CacheBytes:   defaultCacheSize,
 	}
 }
 
@@ -139,9 +151,19 @@ func Load(flagPath string) (Config, error) {
 	}
 
 	applyEnv(&cfg, os.Getenv)
+	cfg.clampFactsTTL()
 	return cfg, nil
 }
 
+// clampFactsTTL pins facts_ttl to maxFactsTTL, remembering the configured value
+// so `config show` can say the cap was applied.
+func (c *Config) clampFactsTTL() {
+	if c.FactsTTL > maxFactsTTL {
+		c.factsTTLClamped = c.FactsTTL
+		c.FactsTTL = maxFactsTTL
+	}
+}
+
 func applyEnv(cfg *Config, getenv func(string) string) {
 	if v := getenv(envPrefix + "LISTEN"); v != "" {
 		cfg.Listen = v
@@ -159,6 +181,16 @@ func applyEnv(cfg *Config, getenv func(string) string) {
 			cfg.FreshnessTTL = d
 		}
 	}
+	if v := getenv(envPrefix + "FACTS_TTL"); v != "" {
+		if d, err := time.ParseDuration(v); err == nil {
+			cfg.FactsTTL = d
+		}
+	}
+	if v := getenv(envPrefix + "FACTS_CACHE_BYTES"); v != "" {
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
+			cfg.CacheBytes = n
+		}
+	}
 	if v := getenv(envPrefix + "BACKENDS"); v != "" {
 		if bs := parseBackends(v); len(bs) > 0 {
 			cfg.Backends = bs
@@ -216,9 +248,19 @@ func (c Config) Validate() error {
 	if c.Timeout <= 0 {
 		return fmt.Errorf("timeout must be positive")
 	}
+	if c.FactsTTL < 0 {
+		return fmt.Errorf("facts_ttl must not be negative (0 disables the cache)")
+	}
+	if c.CacheBytes < 0 {
+		return fmt.Errorf("facts_cache_bytes must not be negative")
+	}
 	return nil
 }
 
+// cacheEnabled reports whether a facts/nodes cache should be built: both a TTL
+// and a byte budget are required.
+func (c Config) cacheEnabled() bool { return c.FactsTTL > 0 && c.CacheBytes > 0 }
+
 func writeDefaultConfig(path string) error {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("creating config dir: %w", err)
@@ -231,7 +273,10 @@ func writeDefaultConfig(path string) error {
 		"# A merging proxy presenting one PuppetDB v4 query surface over several\n" +
 		"# PuppetDB backends. The backend URLs below are placeholders — edit them.\n" +
 		"# Env overrides: PDBMUX_LISTEN, PDBMUX_MERGE, PDBMUX_TIMEOUT,\n" +
-		"#   PDBMUX_FRESHNESS_TTL, PDBMUX_BACKENDS (name=url,name=url).\n\n")
+		"#   PDBMUX_FRESHNESS_TTL, PDBMUX_FACTS_TTL, PDBMUX_FACTS_CACHE_BYTES,\n" +
+		"#   PDBMUX_BACKENDS (name=url,name=url).\n" +
+		"# facts_ttl caches merged /facts and /nodes in memory; it is capped at 30s\n" +
+		"# (a larger value is clamped) and 0 disables the cache.\n\n")
 	if err := os.WriteFile(path, append(header, data...), 0o644); err != nil {
 		return fmt.Errorf("writing config: %w", err)
 	}