Bounded legacy auth fallback cache

Legacy auth fallback now caches both positive and negative results with a short TTL, preventing repeated upstream identity-provider calls on cold cache or token-rotation spikes.