feat(distance): use plugin store for cache, budget - #79

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="122" />
<code_context>
+        if not self.enabled or self.failed:
+            return False, None
+        try:
+            value = self.store.get(self.store.key_for(LOCATION_KEY, key))
+        except StoreError as exc:
+            self._failure(exc)
</code_context>
<issue_to_address>
**Stored addresses are enumerable**

When an operator enables `provider: dbip` without configuring FOCA's store key secret and someone obtains a database or backup read, `StoreCache.get()` and `UserBudget.__init__()` call `store.key_for()` without requiring a secret, so with the default unkeyed hashes a reader of the database or a backup can brute-force public IPv4 addresses and associate them with stored locations; caller identifiers can also be guessed. The README acknowledges this exposure but only recommends setting a secret.

Require a configured secret for DB-IP storage, or use a keyed derivation that is available by default.

Also at `plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py:198`.
</issue_to_address>

### Comment 2
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="54" />
<code_context>
+        if (
+            isinstance(number, bool)
+            or not isinstance(number, int | float)
+            or not math.isfinite(number)
+        ):
+            return False, None
</code_context>
<issue_to_address>
**Malformed coordinates break routing**

When the plugin store contains a location list with an integer too large for float conversion, `_location` passes arbitrarily large integers to `math.isfinite`, which raises `OverflowError` when the integer cannot be converted to a float. `StoreCache.get` does not catch it, so reading that entry aborts routing instead of treating the entry as invalid.

Catch `OverflowError` while validating stored numbers, or convert them to floats with the same guarded validation used by `coordinates`.
</issue_to_address>

### Comment 3
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="214" />
<code_context>
+        if self.exhausted or self.failed:
+            return False
+        try:
+            count = self.store.increment(self.key, ttl=BUDGET_WINDOW, limit=self.limit)
+        except StoreError as exc:
+            self.failed = True
</code_context>
<issue_to_address>
**Daily lookup limits expire early**

When the plugin store's `max_ttl` is shorter than 86,400 seconds, `UserBudget.take()` requests a one-day TTL, but the store caps it at `max_ttl`, so the counter expires early and the caller can start another budget window before a day has passed, exceeding the configured daily limit.

Ensure budget counters remain valid for the full one-day window, including when the store's `max_ttl` is shorter.
</issue_to_address>

### Comment 4
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="235-238" />
<code_context>
+        if self.failed:
+            return
+        try:
+            count = self.store.get(self.key)
+            if not isinstance(count, int) or count <= 0:
+                return
+            self.store.increment(self.key, -1, ttl=BUDGET_WINDOW)
+        except StoreError as exc:
+            self.failed = True
</code_context>
<issue_to_address>
**Refunds reduce a new window's count**

When a budget counter expires between `give_back()`'s read and decrement, and the decrement runs after expiry, `UserBudget.give_back()` decrements the key without verifying it is still the window that was charged; the decrement can reduce a new window's count or recreate the counter below zero, allowing extra lookups against that window's limit.

Make refunds atomic with the counter-window check so a refund cannot change a different window's count.
</issue_to_address>

### Comment 5
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/__init__.py" line_range="258" />
<code_context>
+        if (
+            self.ctx.remaining() <= 0
+            or (self.max_lookups is not None and self.batch_lookups >= self.max_lookups)
+            or (self.budget is not None and not self.budget.take())
         ):
             self.skipped_lookups += 1
</code_context>
<issue_to_address>
**No-request attempts consume lookup budget**

When the shared cache misses but the provider serves a process-local cache hit, or the DB-IP provider has no HTTP client, `_Locator._lookup()` takes a budget slot before `DbipProvider.locate()` and retains it on a successful provider-cache return; when `ctx.http` is absent, `PluginError` also escapes without the `LookupFailed(sent=False)` refund. These no-request attempts consume the caller's allowance and can cause later lookups to be skipped.

Refund the budget slot whenever the provider completes without sending a request, including cache hits and errors before a request is sent.

Also at `plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/__init__.py:259`.
</issue_to_address>

### Comment 6
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="220" />
<code_context>
+            self.log.warning("Plugin store unavailable for the budget: %s", exc)
+            return False
+        if count is None:
+            self.exhausted = True
+            self.log.info("The caller's daily budget of lookups is used up")
+            return False
</code_context>
<issue_to_address>
**Refund leaves budget exhausted**

When one call observes an exhausted budget and another call subsequently refunds a lookup that sent no request, a caller's `UserBudget` object remembers an exhausted count even after another concurrent call refunds an unused lookup. Later lookups in the first call keep getting skipped although the shared counter has room, so the caller gets fewer locations than its remaining budget allows.

Do not memoize exhaustion while concurrent refunds can free capacity; recheck the shared counter for later lookups or use a design that makes exhaustion and refunds visible to all budget instances.
</issue_to_address>

### Comment 7
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="198" />
<code_context>
+        """
+        self.store = store
+        self.key = store.key_for(
+            BUDGET_KEY, principal.subject_type or "", principal.subject or ""
+        )
+        self.limit = limit
</code_context>
<issue_to_address>
**Anonymous callers share an exhaustible budget**

When the gateway accepts anonymous requests and the DB-IP provider is enabled, `UserBudget` maps every principal with missing identity fields to the same key, so one unauthenticated caller can consume the shared daily allowance and prevent other anonymous callers from using DB-IP location lookups; their routing falls back without the distance information.

Require an authenticated principal for this budget or define an explicit anonymous policy that does not let one caller exhaust every anonymous caller's allowance.
</issue_to_address>

### Comment 8
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="157-159" />
<code_context>
+        """
+        if not self.enabled or ttl <= 0:
+            return
+        cached, _ = self.get(key)
+        if not cached:
+            self.put(key, value, ttl)
+
+
</code_context>
<issue_to_address>
**Failed lookups overwrite cached locations**

When a service failure and a successful lookup for the same address overlap, `StoreCache.add()` checks for an existing entry and writes the failure marker in separate operations, so the failure can overwrite the successful location; later calls treat the address as unlocated until the failure entry expires.

Make the failure-marker write conditional and atomic with checking that no entry exists.
</issue_to_address>

### Comment 9
<location path="plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py" line_range="122" />
<code_context>
+        if not self.enabled or self.failed:
+            return False, None
+        try:
+            value = self.store.get(self.store.key_for(LOCATION_KEY, key))
+        except StoreError as exc:
+            self._failure(exc)
</code_context>
<issue_to_address>
**Concurrent misses send duplicate requests**

When multiple callers miss the shared cache for the same address before any lookup completes, `StoreCache.get()` allows both callers to observe a miss before either writes a result, so both invoke the provider and send requests, consuming upstream quota and each caller's budget.

Coordinate in-flight lookups for the same address so only one caller invokes the provider.

Also at `plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/store.py:140`, `plugins/tes/routing/distance/src/foca_plugins/tes/routing/distance/__init__.py:409`.
</issue_to_address>