docs(http-cache): align HTTP caching docs and docstrings with the code

[allen0099]

Docs/docstring accuracy audit of the HTTP caching area. Documentation, docstrings and comments only; no runtime change (AST check: docstring/comment-only).

Corrections

docs/CACHE_FLOW.md (and zh-TW mirror)

• Overall flow diagram: the cache key was shown as built before the no-store check. It is built only after every bypass check, right before the backend read, so the key builder never runs for no-store or bypassed requests. The diagram now shows the key built at that point, with the vary components.
• Overall flow diagram: the bypass branch left out routes with no positive ttl (ttl=None/0), which skip the backend exactly like private=True. Added. "Cached entry exists, ttl is set" is now "Cached entry exists" (ttl is always positive by then). The diagram also mentions fail_open on read/write and Vary on GET responses.
• Decision-logic pseudo-code: the credential bypass checked only Authorization. It now shows request_credential (Authorization, a session the middleware loaded, non-empty request.session), that it is skipped when the route already bypasses, and where the key is built.
• Section 1 and the FAQ said query parameters are never sorted and told readers to write a custom key builder. sort_query=True does this now.
• Section 2: no_cache=True stores entries only with a positive ttl. The list of decoration-time CacheXErrors now includes the missing cases: ttl type/range, vary, sort_query, and an async key_builder.
• CacheEntry listing was missing the stored_at field. Age was missing from the headers that are never stored.

docs/HTTP_CACHING.md (and zh-TW mirror)

• The key examples for vary had one | too many between the empty query and the next component. The real keys are .../greeting||||||tenant-1|||... and .../me||||||authorization=....
• Credential bypass: routes that skip the backend anyway (private=True, no positive ttl) do not check for credentials. Their Cache-Control is sent unchanged, with no private added.
• Monitoring routes: only keys in the route-key format are listed. CacheManager, session, state and lock keys are skipped.

fastapi_cachex/cache.py

• cache() docstring, cache_authorized: added the same qualification about routes that skip the backend anyway.
• The comment before the cache-hit branch said it runs only without If-None-Match. It also runs when the header did not match.

fastapi_cachex/routes.py

• The docstrings of the two monitoring endpoints now say that non-route keys are skipped.

Possible code issues (not changed)

• fastapi_cachex/cache.py:1178 / 1224-1228: the credential check is skipped whenever bypass_backend is true. On a ttl=0 route with must_revalidate=True, an Authorization request is answered Cache-Control: max-age=0, must-revalidate, without private. RFC 9111 §3.5 lets a shared cache store that response. On positive-ttl routes the library deliberately adds private in this case.
• fastapi_cachex/cache.py:1145 / _with_cache_control: a plain @cache() (no ttl or other directives) sends an empty Cache-Control: header, because _build_cache_control returns "" and it is set unconditionally.