Add token cache stats/admin endpoint and documentation

[michaelw]

Scope

Expose runtime cache visibility so operators can see whether caching is helping and whether entries are being evicted or skipped.

Acceptance Conditions

• Add an HTTP admin listener, disabled or localhost-bound by default unless chart exposes it intentionally.
• Expose GET /cache/stats returning JSON:
  • enabled
  • max_entries
  • size
  • hits
  • misses
  • stores
  • evictions
  • expirations
  • not_cacheable
  • singleflight_shared
• Optional but recommended: expose POST /cache/flush guarded by config, disabled by default.
• Stats endpoint never returns cache keys, subject tokens, exchanged tokens, client secrets, or policy contents.
• Helm values and schema include admin port/config and cache settings.
• docs/configuration.md documents cache behavior, safe defaults, and operational tradeoffs.
• Tests cover stats output shape and no-secret/no-token leakage.

Implementation Approach

• Add a small HTTP server in cmd/ext-authz-token-exchange-service alongside the existing gRPC server.
• Keep admin server independent of Envoy ext-authz gRPC.
• Use atomic counters or a small mutex-protected stats snapshot.
• Add chart port only when admin endpoint is enabled.

[michaelw]

Planning note: this is blocked on #5 and #6. The admin/stats endpoint should reflect the final cache keying, expiry, and cacheability rules rather than baking in an interim cache model.