Fix signed-out learning entry and isolate public format cache

[sarthakagrawal927]

This draft PR publishes a bounded SWE source slice for issue #137 and the SWE middleware portion of SaaS Maker #248. It does not close either issue.

• Signed-out Start Learning CTAs go to the existing /learn route; signed-in users keep the dashboard route. Guest or no-cached-profile startup skips /api/auth/verify; a cached signed-in profile still validates its cookie session.
• Public root HTML and Markdown use separate internal Cache API keys derived from the built shell generation. Requests with cookies, authorization, CF Access JWTs, ranges, conditional/cache directives, query strings, or non-root paths bypass storage. Responses with errors, private/no-store/no-cache or ordinary zero-age policy, Set-Cookie, content encoding, or unrelated Vary are not stored. Downstream responses stay private, no-store. Tests use a URL-only cache double and cover both request orders, warm/cold behavior, auth and response policy boundaries, plus the static-shell max-age=0, must-revalidate exception.

Validation on the published source: pnpm test 1,023/1,023; targeted format-cache suite 30/30; pnpm check passes. Current-head GitHub CI is green, including the quality gate and retained browser qualification build. Local pnpm build stops at the existing auth guard because VITE_GOOGLE_CLIENT_ID is unavailable. CI qualifies its configured build; live-edge behavior and TTFB remain unqualified.

Remaining acceptance: owner review of the learner dashboard experience, real signed-out/signed-in browser qualification, production configuration approval, cold/warm edge request-order tests, and same-workload TTFB measurement. No deploy, cache purge, or credential/config change is included.

Draft; part of #137 and related to SaaS Maker #248. No issue closure.