fix: set cache-control on authenticated JSON responses (#2425)

[Karry2019web]

Closes orchestration-agent#2425

/claim orchestration-agent#2425

Summary

• Add that sets on authenticated JSON responses
• Apply the middleware decision before downstream handlers (body parsing, rate-limiting) to avoid unnecessary work
• Add , , and to authenticated JSON responses
• Clean up request-local state in block to prevent cross-request leaks
• Non-authenticated requests and non-JSON responses are left untouched
• Export from so existing test imports work

Test Plan

• -> 19 passed
• Covers: bearer auth, cookie auth, JSON detection, non-JSON passthrough, unauthenticated bypass, Vary deduplication, exception path cleanup, end-to-end integration with the full FastAPI stack