Add ValkeyCache source for AppConfigFragment merged-view reads

## Objective

Re-introduce a Valkey-backed cache layer for the new BEP-1052
`AppConfigFragment` repository, replacing the cache-source that was
dropped together with the legacy AppConfig table in #11265 (BA-5822).
The merged-view read path (`AppConfigFragmentRepository.app_config(user_id, name)`)
is the hot path for the WebUI bootstrap (BEP-1052 §6) and currently
hits the DB on every request.

## Scope

Mirror the legacy `AppConfigCacheSource` shape on top of the new
fragment-keyed merged view:

- `repositories/app_config_fragment/cache_source/cache_source.py`:
- `get_merged_config(user_id, name)` — cache lookup keyed by
`app_config:merged:{user_id}:{name}`
- `set_merged_config(user_id, name, merged: AppConfigData)` — cache
write with TTL; track membership in a domain set for invalidation
- `invalidate_for_scope(scope_type, scope_id)` —
- `USER`: drop the user's per-name keys
- `DOMAIN` / `DOMAIN_USER_DEFAULTS`: drop every member of the
domain's user set
- `PUBLIC`: drop the whole prefix (or use a small known set)
- `invalidate_for_policy(config_name)` — drop the per-name slice
when an `app_config_policies` row changes
- `repositories/app_config_fragment/cache_source/__init__.py` re-export
- Wire `AppConfigCacheSource` into `AppConfigFragmentRepository`:
- read path: cache lookup → DB fallback → cache write
- bulk write paths (`bulk_create_my` / `bulk_update_my` /
`admin_bulk_*`) invalidate after the DB write
- `AppConfigPolicyRepository` writes also invalidate the affected
`name` slice (forwarded through the fragment cache source)
- Use the shared `suppress_with_log` helper so cache failures never
break a request — fall through to DB.
- Unit tests covering hit / miss / invalidate / partial-failure paths.

## Out of scope

- New REST / GQL / SDK / CLI endpoints — read path is unchanged from
the user's perspective; this is a transparent acceleration.
- Cache warm-up on startup.
- Cross-host invalidation events (Valkey pub/sub) — relies on the
existing same-process invalidate calls.

## Acceptance criteria

- [ ] `AppConfigFragmentCacheSource` exists and is wired through the
repository with the same read-around-cache pattern the legacy
`AppConfigCacheSource` used.
- [ ] All BEP-1052 bulk write paths invalidate the affected user /
domain / name slice before the call returns.
- [ ] Cache failures fall through to DB (verified by unit test).
- [ ] `pants check` / `lint` / `test` clean.

## References

- Parent epic: BEP-1052 (#11194)
- Predecessor: legacy `AppConfigCacheSource` removed in #11265
(`src/ai/backend/manager/repositories/app_config/cache_source/cache_source.py`
on `main` history).
- Stack: lands on top of #11295 (BA-5832) — the SDK + CLI PR — so the
full BEP-1052 surface is in place first.

JIRA Issue: BA-5837