refactor: bound local caches and coordinate invalidation

[Medformatik]

Replace four handwritten server caches with bounded lru-cache stores. Reverse-city and reverse-country results are limited to 4,096 entries, GBFS coverage to 10,000, and autocomplete to 1,000. Keep fixed expiry, successful negative lookups, GBFS request sharing, and autocomplete stale-while-revalidate behavior.

Redis remains responsible for shared results, leases and quotas. Host invalidation now clears affected local copies across workers and fences old or overlapping shared fills; local caching pauses if the notification connection is unavailable. Geocoding keys include provider configuration and resolved backend bindings, and runtime shutdown releases local subscriptions.

Pub/Sub notifications propagate asynchronously; this does not provide a linearizable cross-worker read barrier. Entry limits are budgets, not byte-size guarantees. Scoped Redis deletion retains its existing glob semantics; affected integration-local copies are flushed conservatively.

Verification

• pnpm verify:full passed: lint, all 30 workspace type tasks, policy/generation/OpenAPI checks, and 1,760 test files / 20,333 tests passed (191 tests skipped, including the five separately exercised Valkey tests).
• Real Valkey 9.1.2: five tests passed, covering concurrent clears, atomic fill fences, persistent writes, scoped notifications and actual subscriber reconnect.
• API production build and clean-context linux/amd64 docs image build passed.
• Production dependency audits passed with existing acknowledged advisories.
• Independent review completed; provider binding identity finding fixed and re-reviewed.
• Knip retains three existing unused-dependency reports. Duplicate scan flags two existing sharing-setup blocks changed by the one-line disposal hook; no new cache-service clone.
• Database, browser/native-device and production acceptance checks were not run; this changes server cache behavior without a UI change.

Release and upgrade impact

No package release: the changed packages are private server/framework workspaces; published extension contracts and SDK outputs are unchanged.
Product impact: none

Caches repopulate normally under the new identities. No migration or operator action is required. No compatibility fallback is retained.