fix: improve Cloudflare cache hit rate

[crowlKats]

Summary

• Use URL-only cache keys in cachedFetch: The previous implementation used the full request (including per-client headers like Cookie, CF-Connecting-IP, X-Forwarded-For) as the cache key, making every request effectively unique. Now uses a stripped URL-only GET key, matching the pattern already used by proxyToR2.
• Only set Vary: Cookie, Authorization on non-cacheable responses: Previously set on ALL responses including cacheable anonymous ones, which fragmented the cache since every unique cookie/auth value created a separate cache entry.
• Additional safety checks: Only cache GET/HEAD requests, respect backend Cache-Control directives (private/no-store), only cache 2xx responses, serve HEAD from cached GET.

Closes #1371

Test plan

• Added 9 new tests covering: URL-only cache key, cache reuse across clients, auth bypass, cookie auth bypass, POST bypass, private Cache-Control bypass, non-2xx bypass, HEAD-from-cache, login path bypass
• All 14 tests pass (5 existing R2 + 9 new Cloud Run)
• deno check lb/main.ts passes

🤖 Generated with Claude Code