Stand up wai-cache, HTTP caching middleware for WAI

## Summary

A WAI middleware implementing RFC 9111 response caching — freshness, validators, `Vary` — so a Haskell web application gets correct HTTP caching by wrapping its `Application`.

## Motivation

Caching is the REST constraint applications hand-roll worst: a `Map` keyed on the request path, no `Vary`, no revalidation, and a stale-response bug that only appears once a second client sends a different `Accept`. Implementing it once as middleware puts the RFC semantics below the application instead of scattered through every handler.

## Scope

- Create the repo via the `scaffold-repo` flow, with `environments = { hackage = {} }` if it publishes (matching `collection-json.hs` and `network-arbitrary`).
- Suggested module inputs — `description`: "WAI middleware implementing RFC 9111 response caching: freshness, validators, conditional requests, and Vary-aware keys, with a pluggable store."; `topics`: `["haskell", "wai", "http-caching", "middleware"]`.
- Freshness from `Cache-Control` and `Expires`, with the heuristic fallback.
- Validators (`ETag`, `Last-Modified`) driving `If-None-Match` / `If-Modified-Since` and 304 responses.
- `Vary`-aware cache keys — the part hand-rolled caches skip.
- Invalidation on unsafe methods per RFC 9111 §4.4.
- Store behind a typeclass with an in-memory default, so a Redis or filesystem backend lands later without touching the middleware.
- Property tests over the freshness and validator state machine rather than fixture-by-fixture assertions.

## Open questions

1. **Shared or private cache.** Proxy semantics (`private` responses uncacheable, `Authorization` handling, `s-maxage`) versus a private cache. This changes the correctness rules throughout, so it's the first decision, not a later flag.
2. **Name.** Hackage convention is `wai-middleware-*`, and `wai-middleware-caching` already exists there — check what it covers before naming this.
3. **Hackage publication.** Day one, or after the shared/private question settles? Determines whether the module block needs the `hackage` environment now.

## Additional context

Adjacent to #411 — that tool grades exactly the cache behaviour this middleware provides.

## Done when

- [ ] Repo created and adopted into Terraform (module block + `import`)
- [ ] Follow-up filed to drop the adoption `import` after apply
- [ ] Open questions above resolved and recorded in the new repo
- [ ] First milestone issue opened in the new repo