perf(api): CUST-WP-0041 — DB indexes, TTL caches, noload on list endpoints

- Migration t7o8p9q0r1s2: indexes on tasks.status, tasks(workstream_id,status),
  workstreams.status, sbom_snapshots(repo_id,snapshot_at)
- workplan-index: 30 s TTL cache + ?refresh param (4171 ms → 16 ms on hit)
- /state/summary: 15 s TTL cache, bypassed on Cache-Control: no-cache
- /topics/: noload(workstreams, decisions, progress_events) (2382 ms → 115 ms)
- /domains/: noload(topics, repos, goals) (2252 ms → 39 ms)
- /repos/: noload(goals) (2222 ms → 599 ms first / fast on repeat)
- conftest: reset TTL caches between tests to prevent bleed-through

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/state.py

@@ -1,6 +1,7 @@
+import time
 from datetime import datetime, timedelta, timezone
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from fastapi.responses import JSONResponse
 from sqlalchemy import func, select, text
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -41,9 +42,20 @@ from task_flow_engine import FlowEngine
 
 router = APIRouter(prefix="/state", tags=["state"])
 
+_SUMMARY_CACHE: StateSummary | None = None
+_SUMMARY_CACHE_AT: float = 0.0
+_SUMMARY_TTL = 15.0
+
 
 @router.get("/summary", response_model=StateSummary)
-async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSummary:
+async def get_summary(
+    request: Request,
+    session: AsyncSession = Depends(get_session),
+) -> StateSummary:
+    global _SUMMARY_CACHE, _SUMMARY_CACHE_AT
+    no_cache = "no-cache" in request.headers.get("cache-control", "")
+    if not no_cache and _SUMMARY_CACHE is not None and (time.monotonic() - _SUMMARY_CACHE_AT) < _SUMMARY_TTL:
+        return _SUMMARY_CACHE
     # Run all queries sequentially on one session.
     # AsyncSession does not support concurrent operations (no gather on same session).
 
@@ -294,7 +306,7 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
         )
     )).scalar() or 0
 
-    return StateSummary(
+    result = StateSummary(
         generated_at=datetime.now(tz=timezone.utc),
         totals=totals,
         topics=[
@@ -330,6 +342,9 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
             for w in open_ws
         ],
     )
+    _SUMMARY_CACHE = result
+    _SUMMARY_CACHE_AT = time.monotonic()
+    return result
 
 
 async def _build_domain_summaries(session: AsyncSession) -> list[DomainSummary]: