fix: keep token-key casing, bound lookups, fail a degraded warmup

[matheus1lva]

Summary

Closed-day historical responses used Cache-Control: immutable, so a backfill or repair stayed invisible to browsers for a year. Edge cache keys lowercased token addresses, which mixed callers' echoed keys and collapsed two spellings that carried different timestamp lists. Spot could wait on a stalled Enso socket until the platform killed the worker. Warmup swallowed per-item errors and left the schedule green.

Changes

• Closed-day header is public, s-maxage=31536000, max-age=3600, stale-while-revalidate=86400.
• Canonical cache keys keep token-key casing. Batch and range responses echo every submitted spelling. A price row attaches only to spellings that requested that timestamp (range: days inside [start, end]).
• Spot: 12s batch deadline. Enso: 5s request timeout and transport retries. A per-token UNAVAILABLE sets no-store on the whole response.
• parseTokenKey and bad addresses throw INVALID_INPUT (400). Timestamps must be unix seconds from 0 through 4102444800; millisecond and non-integer values 400.
• Warmup exits 1 when the failure rate is above 0.1, or when attempts ran and 0 rows were written. Gaps still count separately.

Risk / observable output

• Closed-day browser cache is 1h, not 1y. Shared edge still has a 1y s-maxage and is purgeable.
• Two casings of the same token are distinct cache entries. A request with {lower:[t1], checksum:[t2]} returns t1 under lower and t2 under checksum, not the union under both.
• Spot 200s that include a transient failure are no-store. Permanent NOT_FOUND still uses the 120s spot policy.
• Millisecond timestamps that previously normalized to a day now 400.
• The warmup GitHub Action goes red on a high failure rate or a run that writes nothing.

Test plan

• vitest run test/prices-batch-range.test.ts: 18 passed, including the merge-across-spellings cases (watched RED then GREEN).
• Specs added, not run as a full suite here: closed-day header literal, lander interpolates live constants, Enso AbortSignal.timeout(5000) plus transport retry, spot deadline/no-store, historical 400 for bad address/chain/out-of-bounds timestamp, warmup degraded predicate.

Not run here: tsc, full suite, live Enso, prod-shaped DB / live RPC.

20 files, +436 / -110.