Initial commit: PawletCache, device-side LAN content-cache resolver

Bound service BgUpd consults before downloading component assets:
discovers a trusted cache server (mDNS and/or central lookup, policy-
configurable), verifies its signed CacheToken against a pinned root key,
and hands back a rewritten URL + TLS pin. Three-tier discovery policy
(runtime MDM override -> vendor-baked default -> compiled default).

Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).

aidl/pawletos/cache/IPawletCacheService.aidl

@@ -0,0 +1,24 @@
+/*
+ * SPDX-FileCopyrightText: oxmc / PawletOS
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package pawletos.cache;
+
+interface IPawletCacheService {
+    // Rewrites originUrl to a local cache URL if a trusted cache server is
+    // currently active and its allowlist covers this origin; otherwise
+    // returns originUrl unchanged. Never blocks on network — resolution
+    // reads state refreshed in the background (see PawletCacheService),
+    // so this is safe to call before every download.
+    String resolveAssetUrl(String originUrl);
+
+    // Base64 SHA-256 of the active cache's TLS SubjectPublicKeyInfo, for the
+    // caller to pin its HTTPS connection against — the cache's cert is
+    // self-signed, this fingerprint (verified against the signed CacheToken)
+    // is the actual trust anchor, not a CA chain. Null if no cache is active.
+    String getActiveCacheTlsSpkiSha256();
+
+    // Diagnostics for a future settings UI.
+    boolean isCacheActive();
+    String getActiveCacheHost();
+}