Architecture rework: fix protocol bugs, add origin-side cache, document spec

8-expert review identified 3 bugs in shipped code (Vary header hallucination,
fn/function wire key mismatch, max-age=0 defeating PSR) — all fixed with
tests updated across Python and TypeScript.

Added: manifest version field, affects validation, wire format convention,
origin-side cache module (HMAC key derivation, MemoryCache + RedisCache
backends, reverse index for scoped invalidation, executor integration).

16 known issues documented in cache/KNOWN_ISSUES.md from expert review —
critical items (user_id not passed, purge race condition, no Redis error
handling) to be fixed in follow-up.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -17,7 +17,7 @@
 - **Shapes** — Pydantic + django-readers for typed query projections
 - **WebSocket channels** — real-time bidirectional communication
 - **Codegen** — generates typed React providers, hooks, mutations from schema
-- **CDN-ready headers** — `Cache-Control`, `Vary`, deterministic JSON on context GETs, `no-store` on mutations
+- **CDN-ready headers** — `Cache-Control`, deterministic JSON on context GETs, `no-store` on mutations
 
 ### Next: X-Mizan-Invalidate Header
 
@@ -128,8 +128,7 @@ The protocol is the product. Two invalidation transports. Every endpoint CDN-rea
 GET /api/mizan/ctx/<name>/?param=value
 
 200 OK
-Cache-Control: public, max-age=0, stale-while-revalidate=300
-Vary: Authorization, Cookie
+Cache-Control: public, max-age=0, s-maxage=31536000
 
 {
     "function_a": { ... },