Cache by tag and purge on publish, instead of a 60 second window

Public delivery sets `Cache-Control: public, max-age=60` (`barakoCMS/Features/Public/Endpoints.cs:275`). That is the whole caching strategy, and it has both failure modes at once: a breaking-news correction is stale for up to a minute, and a page nobody edited for a year is refetched every minute anyway.

The pattern that fixes both is cache by tag, purge on publish. Cache at the edge for a long time, and when an entry publishes, purge exactly the keys that entry appears in.

## What to add

**In core.** Emit a tag header on delivery responses naming what the response was built from: the entry id, its content type, and the tenant. `Surrogate-Key` is Fastly's spelling and `Cache-Tag` is Cloudflare's; both are a space-separated list, so one header value with two names costs nothing.

**In a module.** A purge client that calls the CDN when content publishes, driven off the same event the export and the build trigger use.

## Why it belongs with the two already filed

- #546: cacheable for 60 seconds with no `Vary`, while the tenant comes from a header. The tag has to carry the tenant or a shared cache serves one tenant's content to another.
- #549: no ETag or `Last-Modified`, so nothing can answer 304.

Fixing those two as spot fixes gets a correct but still short-lived cache. Doing them alongside this gets a cache that can hold content indefinitely and still be correct within a second of a publish, which is the difference between surviving a traffic spike and not.

## The part that is easy to get wrong

A list response is built from many entries, so it carries many tags, and publishing any one of them must purge it. Tag the response with every id that contributed, not just the ones on the first page.

## Done when

- A delivery response carries tags for the tenant, the type and every entry in it.
- Publishing an entry purges every cached response that entry appeared in, proven against a real edge or a stand-in.
- The tenant is in the tag, so a purge cannot cross a tenant boundary.

Start in barakoCMS/Features/Public/Endpoints.cs at the delivery response and trace the publish event already used by the export and build trigger. Identify how list responses collect their contributing entries and how the CDN purge client can be exercised against a real edge or stand-in. Done means tenant, type, and every contributing entry are tagged, and publishing purges all responses containing that entry without crossing tenants.

Written by the indexing model from the issue text.