fix(cache): mark auth-required responses no-store instead of 1h public

[amrtgaber]

Summary

• The /v1 path migration in #149 left the Cache-Control middleware's path prefix check (startswith("/user/")) pointing at pre-v1 routes, so authenticated endpoints silently fell into the public-cache branch — prod was emitting Cache-Control: public, max-age=3600 on GET /v1/user/inventories and /v1/loadout/* with no Vary: Cookie.
• User-reported symptoms ("deleted inventories reappear on reload", "re-uploaded saves don't show", "re-delete returns 404"): the write path hits the backend correctly while the read path is served from the browser's HTTP cache for up to an hour. Cloud Logging confirmed zero GET requests reaching the API after the DELETE in the repro session — the browser cache was answering them.
• Fix couples the cache decision to the auth dependency itself: get_current_user sets request.state.auth_required = True (before any raise, so 401s are also flagged), and the cache middleware emits Cache-Control: no-store + Vary: Cookie whenever that flag is present. Any future auth-required route is covered automatically by depending on get_current_user — no prefix list to maintain.

Test plan

• uv run pytest — 24 passed, including new TestCacheHeaders class
• uv run ruff check / ruff format --check — clean
• Verified header on rebuilt local stack:
  • GET /v1/blades → Cache-Control: public, max-age=3600
  • GET /v1/user/inventories (unauthed 401) → Cache-Control: no-store + Vary: Cookie
• After deploy, verify prod GET /v1/user/inventories returns Cache-Control: no-store and a repro of the original delete→reload flow no longer sticks