Cache the STORE-backed provider queries

[abdotop]

Depends on: Issue 8

Add a background refresh + TTL cache in front of each provider's list()
so Issue 8/9 don't hit the STORE on every request. See §6 and §7's
store-load risk.

Acceptance criteria

• list() results are served from cache within the TTL window
• A refresh failure doesn't take down the endpoint (serve stale data,
  log the error)