Add tools/cache package that re-exports luxfi/cache Cacher interface and LRU, plus a TTL wrapper for time-based expiration. Migrate the hand-rolled JWKS key cache in tools/security to use cache.TTL.