Add X-Cache HIT/MISS header to cached API responses

[bpepple]

Description

The Redis-backed response caching added in #603 had no way to confirm from outside the process whether a given response actually came from the cache or was recomputed — checking required either comparing response timings or inspecting Redis keys directly via redis-cli.

Every response that goes through cache.get()/cache.set() — retrieve, list, issue_list-style detail actions, and PublisherViewSet.series_list — is now tagged with an X-Cache: HIT or X-Cache: MISS header via a shared _mark_cache_status() helper, so it's a plain curl away:

curl -sI -H "Authorization: Bearer <your-token>" https://metron.cloud/api/issue/1/ | grep -i x-cache

A viewset/action with caching disabled (Collection/PullList/WishList/ ReadingList — user-scoped, never cached) gets no header at all rather than a misleading MISS, so the header's presence also doubles as confirmation that caching applies to a given endpoint at all.

Test plan

• Added tests covering all four cache-wrapping code paths (retrieve, list, issue_list action, publisher series_list), asserting MISS on first request and HIT on the immediate repeat.
• Added a test confirming an uncached viewset gets no X-Cache header.
• Full test suite passes.