Unify lazy get-or-create for the proxies; `CacheBackend` and `get_state_manager` lack fallback and locking

[allen0099]

Problem

The "use the registered instance, else create a default" logic exists three times:

• get_backend_or_fallback() (proxy.py): double-checked lock.
• get_app_cache() (dependencies.py): double-checked lock.
• get_state_manager() (state/dependencies.py): no lock.

get_cache_backend / CacheBackend does not fall back at all, so it answers 500 (BackendNotFoundError) until some @cache route has run, the same order dependence AppCache no longer has.

Proposal

• Add ProxyBase.get_or_create(factory) with a per-class lock and use it in all three places.
• Let CacheBackend use get_backend_or_fallback().

Not breaking.