perf(nodes): port upstream region membership cache (#2102)

[dborup]

Summary

Port upstream Kpa-clawbot/CoreScope#2102 to this fork: cache /api/nodes?region= node membership by normalized region set, reuse it across count/page requests, refresh additions incrementally after 30 seconds, and rebuild fully every 30 minutes for retention and IATA changes.

Fork-specific changes

• Keep the fork's legacy ADVERT behavior while its asynchronous from_pubkey backfill is incomplete: fall back to decoded_json.pubKey for rows whose from_pubkey is NULL.
• Fix an upstream review finding: replacing an existing cache entry at the 32-entry limit no longer clears the other 31 entries.
• Add focused regression tests for cache reuse, the 32-entry replacement, legacy backfill/delta refresh, and full rebuild after pruning.

Performance and behavior

• The cache is bounded to 32 region sets. A cold region set needs one full observation scan; fresh subsequent pages do not scan membership again. TestNodeRegionCachePortMembershipAndReuse enforces one scan across three equivalent region requests.
• Stale entries are served while one background refresh runs. Region additions may take up to 30 seconds to appear; removals or IATA changes may take up to 30 minutes. This is the upstream cache contract, not immediate-consistency behavior.
• No schema, ingestor, frontend, workflow, configuration or customizer changes.

Verification

• Full cmd/server Go test suite and go vet ./... passed locally.
• Focused region tests passed with -race.
• Full cmd/ingestor Go test suite passed locally. The first sandboxed run could not bind the local MQTT test sockets; rerunning with local test sockets allowed passed.
• Browser validation after push: a local, migrated copy of the E2E fixture was served on loopback. The Nodes page rendered 202 rows; selecting SJC narrowed it to 20 rows, and selecting All restored 202. No browser console errors. The local server was stopped afterward. No staging or production contact.

This is a port for review, not a deployment. No issue-closing keywords or auto-merge.

Related open PR #38 also changes the Nodes region query to use from_pubkey; review its overlap before merging either PR.