Drift item #6: verify HashMap::clear()/remove()/replace drop CachedKey values triggering ZeroizeOnDrop. Adds drop_tracker module proving Drop semantics, plus LRU eviction, TTL expiry, and clear() tests. The lock()-clears-cache criterion is covered by existing test_lock_clears_all_cache_entries in service.rs. Refs: docs/architecture/crates/vault/README.md drift #6