llm_service: opt-in Bedrock prompt caching via cache_prefix

Add a cache_prefix parameter to call_llm. When provided for a Claude
model, the stable text (system prompt, ASVS requirement text, shared
inventory) is prepended to the first message as its own content block
marked cache_control={"type":"ephemeral"}, ahead of the volatile
content. litellm translates this OpenAI-format marker to Bedrock's native
cachePoint; cached input bills at ~10% on a hit.

- Marker carries NO ttl (Bedrock 400s on ttl; litellm #17250/#15880).
- Injection builds a NEW message list; caller's messages are not mutated.
  Handles str content, existing block-form content, and empty lists.
- Gated to Claude models via _supports_prompt_caching; the OpenAI
  'responses' path builds its own input from the original messages and is
  untouched. stream_llm is intentionally not wired (the cached analysis
  path uses call_llm).
- Sub-2048-token prefixes are silently uncached (no error), so pass only a
  genuinely large prefix.

Rebuilt against the current gofannon tree (post bedrock-mythos STS work).
Unit-tested: block placement, no-ttl marker, no caller mutation,
block-form preservation, support gate.