fix: clamp defaultTTL to 24h cap in parseCacheTTL

A configured http.cache.default_ttl >24h would bypass the documented
24h cap because the default return path did not clamp the value.
Now parseCacheTTL clamps defaultTTL at entry so all return paths
(max-age, Expires, and default) respect the cap.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sangwa

internal/endorsements_test.go

@@ -433,6 +433,13 @@ func TestParseCacheTTL(t *testing.T) {
 			}
 		})
 	}
+
+	t.Run("defaultTTL capped at 24h", func(t *testing.T) {
+		got := parseCacheTTL(http.Header{}, 48*time.Hour)
+		if got != 24*time.Hour {
+			t.Errorf("parseCacheTTL() with 48h default = %v, want %v", got, 24*time.Hour)
+		}
+	})
 }
 
 // --- parseByteSize ---

internal/fetch.go

@@ -122,6 +122,9 @@ func (s *Server) fetchHTTPClient() *http.Client {
 // Cache-Control for max-age and no-cache/no-store, falls back to the
 // Expires header, and defaults to defaultTTL. TTL is capped at 24 hours.
 func parseCacheTTL(header http.Header, defaultTTL time.Duration) time.Duration {
+	if defaultTTL > fetchMaxTTL {
+		defaultTTL = fetchMaxTTL
+	}
 	if cc := header.Get("Cache-Control"); cc != "" {
 		lower := strings.ToLower(cc)
 		if strings.Contains(lower, "no-cache") || strings.Contains(lower, "no-store") {