feat(cli): implement ts dev audit headers cache-header audit (#834)

[vasujain00]

Summary

Implements the origin cache-header audit designed in the #834 spec (PR #930). ts dev audit headers fetches origin responses — explicit URLs or discovered from the origin root HTML — classifies each by content type, evaluates cache directives, and reports a per-type pass/warn/fail verdict.

Changes

Area	Change
commands/dev/audit/mod.rs	New DevAuditCommand group + exit-code dispatch
commands/dev/audit/headers/rules.rs	ContentTypeGroup taxonomy, unit Verdict enum, per-group cacheability rules
commands/dev/audit/headers/fetch.rs	AuditHeadersArgs, OriginClient trait + reqwest blocking impl, HTML-parse discovery
commands/dev/audit/headers/analyze.rs	Worst-of rollup per group, summary, exit-code mapping
commands/dev/audit/headers/output.rs	Writer-injected human table + JSON
commands/dev/mod.rs	Adds cross-platform Audit variant to existing DevCommand
Cargo.toml	reqwest (blocking) scoped to cfg(not(target_arch = "wasm32"))

Design fidelity

• no-store alone passes HTML/RTB (RFC 9111 §5.2.2.5)
• s-maxage honored as CDN TTL; Vary (User-Agent/Cookie) checked on all cacheable groups
• Surrogate-Key only checked on cacheable groups; MIME params stripped before classification
• Discovery HTML-parses the origin root — never probes edge-only /_ts/ routes
• Audit is available on all host platforms (unlike the macOS-only proxy)

Closes

Refs #834

Test plan

• cargo test --package trusted-server-cli --target <host> — 105 pass (25 new)
• cargo clippy --package trusted-server-cli --all-targets -- -D warnings — clean
• cargo fmt --all -- --check — clean
• ts dev audit headers --help renders

Checklist

• Follows AGENTS.md conventions (CliResult string errors, writer injection)
• No unwrap() in production code
• Uses log macros (not println!) outside the output sink
• New code has tests
• No secrets committed