ENG-1405: Optimize recall with LRU blob cache and batched SEAL decrypt

[ducnmm]

Summary

• Add in-process LRU cache for Walrus blob ciphertext — warm recall skips aggregator round-trip (~500ms–2s saved)
• Add batched SEAL decrypt (/seal/decrypt-batch) — one sidecar call for all blobs vs N×200–500ms
• Add per-phase timing logs (embed, vector search, walrus fetch, seal decrypt)

Files changed

• services/server/src/seal.rs — seal_decrypt_batch(), DecryptOutcome enum
• services/server/src/routes.rs — recall rewrite with cache-first fetch + batch decrypt
• services/server/src/types.rs — blob_cache field, DEFAULT_BLOB_CACHE_SIZE
• services/server/src/main.rs — blob cache initialization
• services/server/Cargo.toml — lru = "0.12"

Test plan

• cargo check passes
• Server starts without errors
• Recall returns correct results (first call cold, second call warm from cache)
• Logs show per-phase timing and cache hit/miss counts