Fix H3, H6, H11, H13, M11, M18 — quick wins from expert review

H3: mizanFetch retries 2x on server errors (5xx) and network
failures. 200ms/400ms backoff. Mutations NOT retried (not idempotent).

H6: refreshContext now uses GET /ctx/<name>/ instead of POST /call/.
Context reads go to the context endpoint, not the mutation endpoint.

H11: Python cache key derivation normalizes True→"true",
False→"false", None→"null" for cross-language HMAC consistency
with JavaScript's String() behavior.

H13: Forms isValid now checks that all required fields have been
touched, not just that touched fields have no errors.

M11: execute_function return type updated to include HttpResponseBase
for view-path functions.

M18: registerContext cleanup uses ?. instead of ! to prevent crash
if Map was cleared (already fixed in H2 commit but documenting).

373 Django + 33 React tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/mizan-django/src/mizan/cache/keys.py

@@ -32,7 +32,18 @@ def derive_cache_key(
     Returns a prefixed key: "ctx:{context}:{hmac_hex}" so that
     broad purge can SCAN by prefix "ctx:{context}:*".
     """
-    sorted_params = {k: str(v) for k, v in sorted(params.items())}
+    def _normalize(v: Any) -> str:
+        """Normalize values for cross-language HMAC consistency.
+        Python str(True)="True" but JS String(true)="true". Use JSON-native forms."""
+        if v is True:
+            return "true"
+        if v is False:
+            return "false"
+        if v is None:
+            return "null"
+        return str(v)
+
+    sorted_params = {k: _normalize(v) for k, v in sorted(params.items())}
 
     key_data: dict[str, Any] = {"c": context, "p": sorted_params, "r": rev}
     if user_id is not None:

packages/mizan-django/src/mizan/client/executor.py

@@ -23,7 +23,7 @@ from enum import Enum
 from functools import wraps
 from typing import TYPE_CHECKING, Any, Callable
 
-from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.http import HttpRequest, HttpResponse, HttpResponseBase, JsonResponse
 from django.views.decorators.csrf import csrf_protect
 from pydantic import BaseModel, ValidationError
 
@@ -346,7 +346,7 @@ def execute_function(
     request: HttpRequest,
     fn_name: str,
     input_data: dict[str, Any] | None = None,
-) -> FunctionResult | FunctionError:
+) -> "FunctionResult | FunctionError | HttpResponseBase":
     """
     Execute a registered server function.