feat(proxy): kamal proxy cache CLI — stats and purge

[mhenrixon]

Summary

The last F4 follow-up: kamal-proxy ships a full cache admin subsystem (cache stats, cache purge) with zero gem surface — the docs pointed operators at raw proxy logs to find out why nothing was caching.

• kamal proxy cache stats — what the cache is holding; --count measures entries/bytes per service (walks a shared store's keyspace, per the proxy's own flag help), --json for the raw report
• kamal proxy cache purge — drops this app's cached responses, --path-prefix /assets to narrow; audited via the usual auditor record
• Layer routing follows the layering contract: with a loadbalancer, cache policy is edge-only, so both subcommands exec on the LB container against the bare service name; without one, they run on each proxy host — purge walks every proxied role's registered service (app-web, …)
• Docs: the cache section's "when it is not caching" guidance now starts with kamal proxy cache stats, and a new "Administering it" paragraph replaces the raw-logs-only pointer

Closes #99

Test plan

• Command shapes on Commands::Proxy and Commands::Loadbalancer (with/without --count/--json/--path-prefix)
• CLI routing: proxy hosts vs loadbalancer for both subcommands; flag passthrough; unknown-subcommand message
• bundle exec rubocop --parallel clean; full unit suite green (1311 runs)
• CI

Deviations & judgment calls

• Purge scope is app roles only — accessories also register proxy services, but they are never LB-fronted and their cache policy is their own; purging them from an app-scoped command felt like surprise blast radius. kamal proxy cache purge walks roles_on(host).select(&:running_proxy?). If accessory purging is wanted, it fits better as an kamal accessory concern later.
• No deploy lock on purge — it mutates the runtime cache, not deploy state, and can't race a deploy meaningfully; it does write an audit record (Purged the response cache), matching the mutation/observation split elsewhere in the file.
• Purging a service with no cache enabled is allowed — kamal-proxy answers "Purged 0 cached responses", which is more informative than a gem-side guard.
• --path-prefix validation is left to the proxy (it rejects prefixes not starting with / in preRun) — one validator, one error message, no drift between the two.
• Thor options are declared once on the cache command for both subcommands (--count/--json are stats-only, --path-prefix purge-only), matching how boot_config handles its subcommand options.