perf(statuses): align stack-status cache TTL and invalidation with polling (#1814)

The 3s stack-statuses cache TTL never survived the 10s dashboard poll, so
every ordinary poll recomputed. Raise the TTL to 15s and move the git-source
label and self-identity enrichment inside the cached payload so cache hits
serve fully decorated statuses with zero per-request work.

Invalidation closes the gaps the longer TTL would otherwise widen:

- DockerEventService drops stack-statuses:<nodeId> on container state events
  so the UI's state-invalidate refetch recomputes instead of hitting a stale
  entry. The narrow key only: container events do not reshape stack identity
  or file roots, and the stats key self-refreshes on its own 2s TTL.
- git-source link and unlink invalidate node caches before responding, so the
  source label stays fresh without waiting for the TTL.
- a payload whose enrichment degraded (identity probe failure or git-source
  scan failure) is never cached, so a mislabeled not-self or 'local' badge
  cannot persist for a full TTL window. Running outside Docker is not
  degradation, so host installs cache normally.

backend/src/services/DockerEventService.ts

@@ -3,6 +3,7 @@ import { NodeRegistry } from './NodeRegistry';
 import { NotificationCategory, NotificationService } from './NotificationService';
 import { DatabaseService } from './DatabaseService';
 import SelfIdentityService from './SelfIdentityService';
+import { CacheService } from './CacheService';
 import {
     classifyDie,
     classifyGapExit,
@@ -449,8 +450,14 @@ export class DockerEventService {
         // Push a lightweight state-invalidate signal so connected UIs can
         // refetch stack statuses immediately on a real container event,
         // without waiting for the next polling tick. This is fire-and-forget
-        // and is NOT persisted to the alerts history.
+        // and is NOT persisted to the alerts history. Drop the statuses cache
+        // key alongside the broadcast so the UI's refetch recomputes instead
+        // of serving an entry the event just made stale. The full
+        // invalidateNodeCaches helper is not used: container events do not
+        // reshape the project-name map or file-root allowlists, and the stats
+        // key self-refreshes on its own 2s TTL.
         if (STATE_INVALIDATE_ACTIONS.has(baseAction) && !isSelf) {
+            CacheService.getInstance().invalidate(`stack-statuses:${this.nodeId}`);
             this.notifier.broadcastEvent({
                 type: 'state-invalidate',
                 scope: 'stack',