fix(cache): percent-encode | and % in cache-key host and path

[allen0099]

Summary

Closes #230.

default_key_builder joined the raw Host header and the decoded URL path with |||. Both come from the client, so either could carry the separator and shift the components. Reproduced on master:

GET /x            Host: testserver|||/p   ->  key GET|||testserver|||/p|||/x|||
GET /p%7C%7C%7C/x Host: testserver        ->  same key, served {"p": "x"}

Changes

• fastapi_cachex/types.py: new escape_key_component (% → %25, | → %7C) and unescape_key_component. Encoding % as well keeps the mapping injective, so a path holding a literal %7C cannot collide with one holding |.
• default_key_builder encodes the host and path. The query string is URL-encoded by str(request.query_params) already and is left alone.
• clear_path() on the memory and Redis backends encodes its argument before matching. It still takes the path as the app sees it. Memcached is unchanged, since it only does an exact-key delete.
• The monitoring routes (_parse_cache_key) decode host and path for display.
• Docs:
  • HTTP_CACHING.md (EN and zh-TW): explains the encoding, how clear_pattern() interacts with it, and the one-off miss after upgrading. Recommends TrustedHostMiddleware. The per-user key builder example now uses escape_key_component.
  • CACHE_FLOW.md (EN and zh-TW): key snippet and a note on the encoding.
  • CLAUDE.md: updated.

Compatibility

Keys only change when the host or path contains | or %. Everything else hits the existing entries after the upgrade.

Tests

• tests/test_cache_key.py::TestCacheKeySeparatorInComponents:
  • the Host-poisoning repro;
  • % encoding, built from a raw scope, because TestClient decodes the path twice;
  • ordinary keys are unchanged;
  • escape/unescape round-trips injectively;
  • the monitoring parser decodes.
• tests/backends/test_clear_pattern_contract.py::test_clear_path_finds_paths_with_encoded_characters runs on memory and Redis.
• Mutation-checked five reverts: builder without escaping, no % escaping, memory clear_path raw, Redis clear_path raw, routes without unescape. Each fails only the new tests aimed at it.
• The full suite passes against live Redis and Memcached: 990 passed. Both strict docs builds pass.

CHANGELOG

Added under Unreleased → Security.