perf(doi): fingerprint-based DB cache for DoI results

Adds doi_cache table (migration k8f9a0b1c2d3). Results are stored after
each evaluation and reused on subsequent requests when the fingerprint
matches. Fingerprint covers repo.updated_at, latest TPSC snapshot_at,
latest goal updated_at, and mtime of SCOPE.md / CLAUDE.md / tpsc.yaml.

Behaviour:
- Summary (warm cache, nothing changed): ~0.4s (was 0.9s)
- Summary (one repo stale): ~0.9s (only stale repos recomputed)
- Single repo (cache hit): ~0.2s (was 40s for full check)
- Single repo ?force_refresh=true: ~2s (full C7/C13 subprocess check)

Total journey: 108s (original) → 6s → <1s → 0.2s (cached single repo)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

migrations/versions/k8f9a0b1c2d3_doi_cache.py

@@ -0,0 +1,38 @@
+"""doi_cache: materialised DoI results with fingerprint-based invalidation
+
+Revision ID: k8f9a0b1c2d3
+Revises: j7e8f9a0b1c2
+Create Date: 2026-03-20
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSON
+import uuid
+
+revision = "k8f9a0b1c2d3"
+down_revision = "j7e8f9a0b1c2"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "doi_cache",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, default=uuid.uuid4),
+        sa.Column("repo_id", UUID(as_uuid=True),
+                  sa.ForeignKey("managed_repos.id", ondelete="CASCADE"),
+                  nullable=False, unique=True),
+        sa.Column("tier", sa.String(20), nullable=False),
+        sa.Column("core_pass", sa.Boolean, nullable=False, server_default="false"),
+        sa.Column("standard_pass", sa.Boolean, nullable=False, server_default="false"),
+        sa.Column("full_pass", sa.Boolean, nullable=False, server_default="false"),
+        sa.Column("criteria", JSON, nullable=True),      # full criterion list
+        sa.Column("fingerprint", sa.Text, nullable=False),  # pipe-joined timestamps
+        sa.Column("checked_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+    op.create_index("ix_doi_cache_repo_id", "doi_cache", ["repo_id"])
+
+
+def downgrade() -> None:
+    op.drop_table("doi_cache")