v0.4.0 — /metrics + semantic cache wired

Observability + semantic cache tier now WIRED live: a /metrics endpoint on the management server (RED + gen_ai token/cache counters, secret-free labels, live-proven), an opt-in semantic response-cache tier (Cache.semantic), and Router.think activation. Plus exhaustive verification suites (fuzzers) across cache/metrics/logging/proxy. All opt-in additions default OFF/inert; existing configs byte-identical. Reviewed; full suite green under -race. See CHANGELOG.md.