feat: cold-start InitCache persist for observatory

[ultimaterex]

Summary

• Persist trimmed observatory InitCache in separate KV fw_app_obs_cache_v1 (Rules fw_app_rules_cache_v1 untouched) and hydrate on restart.
• Boot ColdStart: hydrate Rules + observatory, then one coalesced EnsureInit (no background poll).
• Non-PreferInit facades serve past-TTL init as fw-app-init / reason=fallback / stale=true within 24h; PreferInit stays warm-only (empty if rewarm fails).

Spec: docs/superpowers/specs/2026-08-26-cold-start-design.md

Type of change

• New feature
• Docs

---

✅ Required (must be checked to merge)

• I have read the CONTRIBUTING.md.
• I have read and agree to the Contributor License Agreement (CLA).

---

Checklist

• My changes build: go vet ./... and gofmt -l . are clean (and npm run build for UI changes).
• Tests pass: go test fireproxy/server/internal/fwapp fireproxy/server/internal/observatory fireproxy/server/internal/api.
• I added or updated tests for behavior changes, and they are hermetic (no reliance on real host state, network, or /sys).
• No secrets or real network data are committed (no tokens, .env, live dumps, or real MAC/IP/SSID values — use sanitized fixtures).
• I updated relevant docs (README / docs/) if behavior, config, or the API changed.
• The change is focused and reasonably scoped for review.

Test plan

• Restart paired server with recent obs KV: dashboard/devices/box paint before agent connects
• LAN down after restart: past-TTL (≤24h) shows Fallback with stale provenance; PreferInit refresh does not serve stale as prefer
• Snapshot older than 24h is not served
• Unpair clears fw_app_obs_cache_v1
• Confirm no :8833 traffic on agent ingest/metrics tick (health loop still Ping-only)

Notes for reviewers

• Hermetic MemStore restart + facade stale-fallback tests cover the contracts.
• Module health loop remains Ping only; boot fetch is one-shot ColdStart in main.