A pull's Files page reuses its rendered diff for the same head, and nothing viewer-specific is shared #4086

Part one of #4043 (parked twice, too much in one run). Only the cache and its safety; the speed assertion is the next issue. Rebase onto #4020 if it has landed.

Done:

• [ ] The highlighted diff body of pullFilesPage (src/web/pages/pull.ts) is cached keyed by base oid, head oid and the view's options (whitespace, split/unified); review links, comment forms, threads and marks are drawn after the cache, per viewer.
• [ ] The cache is bounded (entries and bytes) and lives in memory only.
• [ ] Tests: a second view of the same head reads the cache (a counter or a cache Server-Timing phase says so); a new head on the same pull renders fresh; two viewers with different permissions each see only their own forms.
• [ ] bun test test/pull-timing.test.ts and the pull tests pass; bun x tsc --noEmit passes.

Files: src/web/pages/pull.ts, perhaps a small new module named for the cache, tests. Risk: leaking one viewer's markup to another; the permission test is the point.

The Server-Timing work from pull #4020 is now #4095, and #4020 is closed. Rebase onto #4095 if it lands first.