data-api: cache /.well-known/entire-api.json like entire-cluster.json

Discovery was re-fetched on every activity/search/trail/dispatch/recap invocation. Cache it the same way the git path caches entire-cluster.json: reuse the generic cache primitives (modifyCacheFile/loadCacheFile/...) for a new api_discovery.json sibling, 24h TTL, with stale-fallback when a re-fetch fails. The entry carries audience alongside issuer/trusted_issuers — the one field that distinguishes a resource API from a git cluster.

• discovery: APIDiscoveryCache / APIDiscoveryEntry (mirrors ClusterCoresCache)
• clusterdiscovery: resolveAPIDoc (mirrors resolveClusterCores); ResolveContextForAPI gains a cacheDir param and goes cache-then-/.well-known
• auth: ResolveDataAPIToken passes discovery.DefaultCacheDir(); test seam + DiscoveryUnavailableForTest grow the cacheDir param

Behavioural upside: a transient discovery outage now reuses last-known-good trust roots instead of dropping to the static fallback — aligning with COR-393's mandatory-discovery direction. Cold failure (no cache entry) still falls back.