phase3: helm charts, security fixes, demo gin app, stability work

[sharmavijay86]

Adds three top-level deliverables and a set of security/stability fixes.

helm/cached/
Production-shaped Helm chart for the cached server: StatefulSet,
headless+ClusterIP services, PDB at quorum, NetworkPolicy,
ServiceMonitor and PrometheusRule (Prometheus Operator), dedicated
ServiceAccount with automountServiceAccountToken=false, auto-generated
AUTH password preserved across upgrades, TLS via existing Secret,
hardened pod/container SecurityContext.

demo/
Gin microservice demonstrating every common cache pattern against
cached via go-redis: cache-aside reads, write-invalidate, atomic
counters, distributed locks (SET NX EX + token release), per-client
rate limiting, pub/sub broadcast, INFO/DBSIZE introspection. Includes
multi-arch Dockerfile, its own Helm chart (cached-demo), and a
dedicated GitHub Actions workflow that only runs on demo/** changes.
README covers required setup, cross-namespace secret sharing, full
endpoint walkthrough.

Security fixes (docs/SECURITY.md tracks the audit):

• F-1: MaxBulkSize default 64 MiB (was 512); configurable via CACHE_MAX_BULK_SIZE. Pre-allocation check before make().
• F-2: RESP array nesting depth limit (default 32) — prevents stack overflow via crafted nested frames.
• F-3: Per-IP failed-AUTH rate limiter (sliding 1-min window, default 30 attempts/min). Successful AUTH resets the counter.
• F-4: MULTI queue caps — 10k commands / 50 MiB per connection.
• F-5: Protected mode: refuse non-loopback when AUTH is disabled.
• F-6: Pre-AUTH read deadline of 10s (slow-loris mitigation).

Stability + perf:

• LTRIM command (was a gap noted in DEVELOPER_GUIDE.md).
• CONFIG GET (read-only subset; CONFIG SET intentionally refused).
• Pubsub deliver closes the connection on slow-consumer write failure so the broker stops fanning out to a dead client.
• Bootstrap-if-host flag eliminates the /bin/sh dependency in the StatefulSet (distroless/static-friendly).

CI:

• Trivy action repinned to @master (the 0.36.0 tag the workflow had didn't exist, breaking the scan job).
• New demo-ci.yml workflow for the demo image; path-scoped so the cached CI doesn't run on demo-only edits and vice versa.

Tests:
go test -race ./... ~80 tests, all green (incl. 3-node Raft).
helm lint both charts pass.
End-to-end smoke demo against cached: cache-aside HIT/MISS,
counter, lock, pub/sub all work.