fix: add package cache refresh before apply and on health check

- New src/packages/cache.rs module with PackageCacheState, stale detection,
  state persistence, 404 retry logic
- Add refresh_package_cache() and last_cache_update() to PackageManagerBackend
  trait, implemented on all 5 backends (APT, DNF, YUM, APK, Pacman)
- Health check now reports last_cache_update and cache_status fields,
  triggers cache refresh if stale (>4h), returns degraded on failure
- Patch apply jobs now force cache refresh before applying patches,
  with 404/fetch error retry (1 retry after cache refresh)
- Cache state persists to /var/lib/linux_patch_api/state/cache.json
- Version bump to 1.1.17
- Update ARCHITECTURE.md and REQUIREMENTS.md (FR-007)

Closes: #2

REQUIREMENTS.md

@@ -50,6 +50,16 @@
 - Log configuration changes (whitelist updates, cert renewals)
 - Log system changes made by the API
 
+### FR-007: Package Cache Refresh
+
+- The agent MUST refresh the local package index before every patch_apply operation
+- The agent MUST refresh the local package index when the health check detects stale cache (>4 hours)
+- The agent SHOULD automatically retry patch_apply once after cache refresh on 404/fetch errors
+- The agent SHOULD track and report last_cache_update timestamp in health check responses
+- Cache state persists to /var/lib/linux_patch_api/state/cache.json across service restarts
+- Cache refresh before apply is mandatory and not configurable
+- Cache refresh timeout is 120 seconds
+
 ---
 ## Non-Functional Requirements