Remove CDN Cache-Control headers; fix cross-language sort bug

Mizan's protocol layers (origin Redis cache, Edge Worker) handle caching
autonomously. The origin emits Cache-Control: no-store on ALL responses —
browsers and non-Mizan intermediaries must not cache. The Edge Worker
controls CDN caching via cf object, independent of origin headers.

Also fixes:
- TS localeCompare → byte-order sort (localeCompare is locale-sensitive,
  would produce different HMAC keys for non-ASCII params vs Python)
- Python cache_purge: empty {} params no longer treated as falsy
  (was inconsistent with JS where {} is truthy)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -17,7 +17,7 @@
 - **Shapes** — Pydantic + django-readers for typed query projections
 - **WebSocket channels** — real-time bidirectional communication
 - **Codegen** — generates typed React providers, hooks, mutations from schema
-- **CDN-ready headers** — `Cache-Control`, deterministic JSON on context GETs, `no-store` on mutations
+- **Protocol-managed caching** — `no-store` on all origin responses, deterministic JSON on context GETs
 
 ### Next: X-Mizan-Invalidate Header
 
@@ -128,7 +128,7 @@ The protocol is the product. Two invalidation transports. Every endpoint CDN-rea
 GET /api/mizan/ctx/<name>/?param=value
 
 200 OK
-Cache-Control: public, max-age=0, s-maxage=31536000
+Cache-Control: no-store
 
 {
     "function_a": { ... },