Add encrypted secret cache to survive provider outages

[jdoss]

Summary

• Adds a single-file encrypted cache at state_dir/cache.enc so psi serve can resolve secrets from memory when the upstream provider is unreachable.
• Two backends, configured per host: tpm (AES-256-GCM key sealed by systemd-creds and delivered via LoadCredentialEncrypted=psi-cache-key) and hsm (reuses the existing Nitrokey hybrid envelope in psi/providers/nitrokeyhsm/crypto.py).
• psi-infisical-setup now eagerly populates the cache from list_secrets responses; serve decrypts once at startup and holds the dict in RAM. Cache misses fall through to the provider and are persisted.

Why

On 2026-04-08, an Infisical outage on homelab.inf7.dev took down every PSI-backed container that needed to restart, because PSI's lookup path was a live HTTP proxy with no caching. The cache closes that single point of failure while keeping the zero-plaintext-on-disk invariant: the file carries a magic + version + backend tag and the payload is encrypted end-to-end.

Graceful degradation: if the backend cannot be opened, or the file is corrupt or written by a different backend, serve logs a warning and falls back to live provider lookups. A missing cache key never takes down the fleet.

New commands

• psi cache init --backend {tpm,hsm} — provisions the key (tpm: systemd-creds encrypt --tpm2-pcrs=7) and writes an empty cache file.
• psi cache refresh — re-runs setup to pull fresh values from providers.
• psi cache invalidate <id> — drops a single entry and persists.
• psi cache status — shows backend, file size, last-write timestamp, entry count. Never prints plaintext.

Systemd changes

Native psi-secrets.service gains StateDirectory=psi and, when cache.backend == tpm, LoadCredentialEncrypted=psi-cache-key:<config_dir>/cache.key.

Test plan

• uv run ruff check psi/ tests/ — clean
• uv run ruff format --check psi/ tests/ — clean
• uv run ty check — clean
• uv run pytest -q — 278 passed (23 new: 20 cache unit tests + 3 offline serve integration tests)
• Deploy to homelab.inf7.dev: bump image, run psi cache init --backend tpm, verify psi cache status shows entries after next psi-infisical-setup run
• Chaos test: block egress to Infisical, reboot host, confirm PSI-backed containers start from cache