Clarify fetch_cache_entry_with_wildcard semantics (effective wildcard merge + explicit no-match contract)

## Context
`fetch_cache_entry_with_wildcard` in `up-streamer/src/routing/subscription_cache.rs` is intended to compute the effective subscriber lookup for one egress authority by merging:
- exact authority rows (`entry`)
- wildcard authority rows (`"*"`)

(except when `entry == "*"`, where wildcard should not be double-counted).

That merge behavior is correct and should be preserved.

## Problem
The current return type `Option` overloads `None` with two meanings:
- no matching subscribers
- cache access/lock failure

This makes the API ambiguous and harder to reason about.

## Proposed Direction
- Represent no-match as an empty lookup.
- If failure signaling is needed, use an explicit `Result` contract:
- `Ok(empty_lookup)` = no matching subscribers
- `Err(...)` = lock/access failure
- Keep wildcard merge semantics unchanged (exact + wildcard).
- Update call sites/tests to align with the explicit contract.

## Why
Current call sites already treat `None` as empty in practice, so this change aligns the API with real behavior and makes intent explicit.