feat(provider): add bounded capability cache

[luoye520ww]

Problem

Provider capability discovery needs a bounded, configuration-aware cache without persisting credentials or allowing stale results to grow without limit.

Scope

This PR adds the cache contract and implementation only. It does not wire a provider probe into the cache; that integration remains a separate reviewable change.

Changes

• Normalize provider/account/endpoint/configuration identity into a stable cache key.
• Strip URL query and fragment data and reject credential-bearing URLs/control characters.
• Add TTL expiration, bounded capacity, explicit invalidation, and injectable time for deterministic tests.

Safety

• No credentials are persisted or returned by the cache.
• Cache keys include credential/configuration version fields so callers can invalidate on changes.
• Entries are memory-only and bounded by TTL and capacity.

Validation

• npm.cmd --prefix kun test -- src/services/provider-capability-cache.test.ts (7 passed)
• npm.cmd --prefix kun run typecheck (passed)
• npm.cmd run typecheck (passed)
• npm.cmd run lint (passed)
• npm.cmd run build (passed)
• git diff --check (passed)

Review performed

Functional correctness, lifecycle/expiry, data isolation, security, compatibility, test quality, and PR scope were reviewed. No blocker or high-severity findings remain.

Follow-ups

Wire the cache into provider discovery/probe paths in a separate PR after this contract lands.

[luoye520ww]

Closing this split PR to reduce review fragmentation. The branch and commits are preserved; this work will be reintroduced in a smaller consolidated PR after the current reliability baseline is merged.

[luoye520ww]

Closed as part of PR consolidation; no branch data was deleted.

[luoye520ww]

Reopened for targeted CI repair and verification; this PR remains in the active fix set.

[luoye520ww]

Superseded by consolidated provider/network safeguards PR #948, which passed Typecheck, Linux, macOS, and Windows packaged checks. Closing this duplicate to keep the review surface focused.