feat(BA-5837): ValkeyCache for AppConfigFragment merged-view reads

[jopemachine]

📚 Stacked PRs

This PR is part of a 10-PR stack delivering BEP-1052. Merge in order:

1. ⬇️ chore(BA-5822): drop legacy AppConfig layer (preparation for BEP-1052) #11265 — chore(BA-5822): drop legacy AppConfig layer
2. ⬇️ feat(BA-5814): AppConfigPolicy foundation (data / repository / service / adapter, bulk-aware) #11266 — feat(BA-5814): AppConfigPolicy foundation
3. ⬇️ feat(BA-5815): AppConfigPolicy GraphQL #11269 — feat(BA-5815): AppConfigPolicy GraphQL
4. ⬇️ feat(BA-5844): AppConfigPolicy REST v2 surface #11312 — feat(BA-5844): AppConfigPolicy REST v2
5. ⬇️ feat(BA-5827): AppConfigFragment foundation (DB + repository + errors) #11282 — feat(BA-5827): AppConfigFragment foundation
6. ⬇️ feat(BA-5836): AppConfigFragment service vertical (service / DTO / adapter) #11296 — feat(BA-5836): AppConfigFragment service vertical
7. ⬇️ feat(BA-5829): AppConfigFragment + AppConfig GraphQL #11285 — feat(BA-5829): AppConfigFragment + AppConfig GraphQL
8. ⬇️ feat(BA-5830): AppConfigFragment + AppConfig REST v2 #11286 — feat(BA-5830): AppConfigFragment + AppConfig REST v2
9. ⬇️ feat(BA-5832): AppConfig v2 SDK + CLI (BEP-1052) #11295 — feat(BA-5832): AppConfig v2 SDK + CLI
10. 👉 feat(BA-5837): ValkeyCache for AppConfigFragment merged-view reads #11298 — feat(BA-5837): ValkeyCache for AppConfigFragment merged-view reads ← you are here

CI on intermediate PRs may show test churn since each one only lands a slice of the new layer. The full picture is guaranteed to build at the tip (#11298).

Closes #11297.

Summary

Re-introduces a Valkey-backed cache layer for the BEP-1052 merged
AppConfig view, replacing the cache source that was dropped together
with the legacy app_configs table in #11265 (BA-5822). The hot path
— AppConfigFragmentRepository.app_config(user_id, name) — is the
WebUI bootstrap loop (BEP-1052 §6) and was previously a DB hit per
request.

What's in here

• repositories/app_config_fragment/cache_source/cache_source.py:
  • get_merged_config(user_id, name) cache-aside read keyed by
    app_config:merged:{user_id}:{name}
  • set_merged_config(merged, domain_name=...) writes the deep-merged
    payload + indexes the key in app_config:user_keys:{user_id} and
    the user in app_config:domain_users:{domain_name} so invalidation
    runs without SCAN
  • invalidate_for_scope(scope_type, scope_id):
    • USER: drop the user's per-name set
    • DOMAIN / DOMAIN_USER_DEFAULTS: cascade through every member
      of the domain user set
    • PUBLIC: rely on TTL (broad invalidation TBD)
• db_source.user_domain_name(user_id) lookup so the cache layer can
  tag merged-view entries with their owning domain.
• AppConfigFragmentRepository.app_config(...) is now cache-aside
  (hit → cached payload + fresh DB fragments; miss → DB read +
  write-through).
• AppConfigFragmentAdminRepository.{create,update,purge} invalidate
  the affected scope after each DB write.
• repositories.py builds the cache source from
  args.valkey_stat_client and threads it into both repos.
• All cache calls pass through suppress_with_log so cache failures
  log a warning and fall through to the DB.

Stack

main
 └─ BA-5822 #11265  legacy AppConfig drop  (removed the original cache source)
     └─ BA-5814 #11266  AppConfigPolicy foundation
         └─ BA-5815 #11269  AppConfigPolicy GQL + REST
             └─ BA-5827 #11282  AppConfigFragment foundation
                 └─ BA-5836 #11296  AppConfigFragment service vertical
                     └─ BA-5829 #11285  AppConfigFragment + AppConfig GQL
                         └─ BA-5830 #11286  AppConfigFragment + AppConfig REST
                             └─ BA-5832 #11295  v2 SDK + CLI  ← base of this PR
                                 └─ BA-5837        ValkeyCache  ← THIS PR

Test plan

• Manager schema build OK; cache source loads cleanly.
• E2E via ./bai:
  • Policy + my-bulk-create populates the user fragment.
  • First app-config my-get theme populates cache.
  • Second my-get returns the same payload.
  • my app-config bulk-update invalidates → next my-get returns the
    updated payload.
• pants check clean on the touched files.
• CI green.

---

📚 Documentation preview 📚: https://sorna--11298.org.readthedocs.build/en/11298/

---

📚 Documentation preview 📚: https://sorna-ko--11298.org.readthedocs.build/ko/11298/

[jopemachine]

Please add unit tests