The flow panel's figures come from one short-lived cache, so a second /boards load inside 30 s runs none of its reads #6974

Second step of #6897. src/web/pages/flow-panel.ts still runs its other reads (pile, conflicted, reviewing, requested, parked, lead time, build yield, review latency, openers, held) on every /boards request. idlePullsCached in src/flow/idle_pulls.ts already shows the pattern.

Done:

• [ ] A new src/flow/panel_cache.ts keeps the panel's figures per database (a WeakMap on the db, as idle_pulls.ts does, never a module global shared across apps). A value holds while the write mark stands still, and for 30 s at most.
• [ ] It is read only after the viewer's rights are known. A public-only answer is kept apart from an admin's, and a test proves an agent never sees an admin's figures.
• [ ] /boards renders the panel from it, and its Server-Timing has a flow phase. A test proves a second load inside the window runs none of the readers, and that a write makes the next load read again.
• [ ] The healthz-gap test from the first step stays green.

Files: src/flow/panel_cache.ts, src/web/pages/flow-panel.ts, test/flow-panel-cache.test.ts

If the test finds the behaviour wrong, fix the module it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.