PR14: Hierarchical config provider + cache manager (bootstrap)

[DMontgomery40]

Implements Phase 3 PR14.

• Adds api/app/services/cache_manager.py (Redis + local fallback)
• Adds api/app/config/hierarchical_provider.py (Fernet-based, async SQLA, hierarchy resolution)
• Wires optional bootstrap in app.state (requires CONFIG_MASTER_KEY; tolerates absence for CI)
• Adds deps in api/requirements.txt: cryptography, redis, sse-starlette

Acceptance greps:

• rg -n "class CacheManager" api/app/services/cache_manager.py
• rg -n "class HierarchicalConfigProvider" api/app/config/hierarchical_provider.py
• rg -n "app.state.hierarchical_config" api/app/main.py

CI: Python tests pass; feature is inert unless CONFIG_MASTER_KEY is set.

[DMontgomery40]

Closing as the hierarchical config provider changes have been merged into auto-tunnel