Implement KeyCache in cache.rs with CachedKey (Zeroize-protected), CacheConfig (TTL + max_entries), and lazy eviction. Wire cache into SecretServiceInner: derive_* methods check cache before re-deriving, Lock clears and zeroizes all cache entries, encrypt/decrypt use cached encryption key. Per ADR-038 and OQ-SVC-04.