feat: add internal BigSegmentStoreWrapper with caching and status polling

[beekld]

Summary

Internal layer between the evaluator and a customer-provided
IBigSegmentStore: hashes context keys, caches membership lookups, polls the
store's metadata in the background to track availability/staleness, and
broadcasts status changes. No caller yet — the evaluator and the public status
provider come later in the stack.

Design notes

• Context keys are hashed to base64(sha256(key)) using the standard base64
  alphabet (not the existing URL-safe Base64UrlEncode), so the lookup key
  matches what the Relay Proxy writes.
• Concurrent misses for the same key coalesce into a single store query rather
  than each hitting the store.
• The background poll is built on async::Delay + CancellationSource.
• A store error encountered during a membership lookup flips the store status to
  unavailable. The spec requires this; the Java and Go SDKs don't do it, so this
  is a deliberate divergence.
• Changes StoreMetadata::last_up_to_date from a bare milliseconds to a
  system_clock::time_point, so staleness math can't mix epochs. This touches
  the Redis and DynamoDB stores (one line each) and their metadata tests.

Test plan

• Added unit tests
• Full server-sdk suite green (499/499)
• DynamoDB source suite green (40/40) against DynamoDB Local
• Redis source suite green (37/37) against a live Redis

---

Note

Medium Risk
Changes the public IBigSegmentStore contract (noexcept, StoreMetadata type) and adds threaded/async polling plus store-error handling that affects how staleness and availability are reported; evaluator is not wired yet, limiting immediate eval impact.

Overview
Adds BigSegmentStoreWrapper, the internal layer in front of IBigSegmentStore: hashes context keys as base64(sha256(key)) via new Base64Encode (RFC 4648, not URL-safe), uses an LRU/TTL MembershipCache, coalesces concurrent lookups for the same key, polls metadata on a timer for availability/staleness, and broadcasts status changes. Membership lookups return BigSegmentsStatus (healthy/stale/store error); a failed lookup marks the store unavailable (per spec).

StoreMetadata::last_up_to_date is now a system_clock::time_point instead of raw milliseconds; Redis and DynamoDB stores and their tests are updated accordingly. IBigSegmentStore::GetMembership / GetMetadata are noexcept, with DynamoDB wrapping AWS calls in try/catch.

Supporting pieces: big_segments_status.hpp, #include <variant> in promise.hpp, and unit tests for the wrapper, cache, and standard base64.

^{Reviewed by Cursor Bugbot for commit 0b492dd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kinyoklion]

A store error encountered during a membership lookup flips the store status to
unavailable. The spec requires this; the Java and Go SDKs don't do it, so this
is a deliberate divergence.

We'll want to determine if we should update the spec here or the implementations. It does sound reasonably though.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c13f1d8. Configure here.}

[beekld]

A store error encountered during a membership lookup flips the store status to
unavailable. The spec requires this; the Java and Go SDKs don't do it, so this
is a deliberate divergence.

We'll want to determine if we should update the spec here or the implementations. It does sound reasonably though.

I've added it to the list of follow-ups where java and the spec aren't in alignment.