perf(api): CUST-WP-0041 — DB indexes, TTL caches, noload on list endpoints

- Migration t7o8p9q0r1s2: indexes on tasks.status, tasks(workstream_id,status),
  workstreams.status, sbom_snapshots(repo_id,snapshot_at)
- workplan-index: 30 s TTL cache + ?refresh param (4171 ms → 16 ms on hit)
- /state/summary: 15 s TTL cache, bypassed on Cache-Control: no-cache
- /topics/: noload(workstreams, decisions, progress_events) (2382 ms → 115 ms)
- /domains/: noload(topics, repos, goals) (2252 ms → 39 ms)
- /repos/: noload(goals) (2222 ms → 599 ms first / fast on repeat)
- conftest: reset TTL caches between tests to prevent bleed-through

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/repos.py

@@ -11,6 +11,7 @@ from pathlib import Path
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 from sqlalchemy import case, func, select
+from sqlalchemy.orm import noload
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.config import settings
@@ -55,7 +56,7 @@ async def list_repos(
     session: AsyncSession = Depends(get_session),
 ) -> list[ManagedRepo]:
     response.headers["Cache-Control"] = "max-age=60, stale-while-revalidate=30"
-    q = select(ManagedRepo).order_by(ManagedRepo.name)
+    q = select(ManagedRepo).options(noload(ManagedRepo.goals)).order_by(ManagedRepo.name)
     if domain:
         domain_row = await session.execute(select(Domain).where(Domain.slug == domain))
         domain_obj = domain_row.scalar_one_or_none()