Perf: parallelize admin loads + edge-cache /api/brief

Two concrete latency wins found by measuring (server compute is 2-17ms; the time
is in the path, not the box):
- Admin panel fired its 6 API calls SEQUENTIALLY (await chain) — so it paid the
  uncached origin round-trip six times back-to-back. Now one Promise.all batch.
  This is the admin lag.
- /api/brief (the home "Gathering the good news…" content) wasn't edge-cached, so
  a distant anonymous visitor triggered a Cloudflare→residential-origin pull.
  Same global/shareable boundary as /api/feed: public s-maxage=45 when no
  prefs/exclude, else private,no-store. (Needs /api/brief added to the CF cache
  rule path list to take effect at the edge.)

Tests: test_brief_cache_boundary. 228 pytest + 11 vitest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

goodnews/api.py

@@ -1676,11 +1676,17 @@ def create_app() -> FastAPI:
 
     @app.get("/api/brief", response_model=BriefResponse)
     def brief(
+        response: Response,
         date: str | None = Query(None),
         limit: int = Query(10, ge=1, le=50),
         prefs: str | None = Query(None),
         exclude: str = Query("", description="comma-separated article ids the reader has dismissed"),
     ) -> BriefResponse:
+        # The default highlights are global (date-keyed, no session) → edge-cacheable
+        # so a new visitor's "Gathering the good news…" resolves from their POP, not
+        # a pull to the residential origin. Personal filters stay private.
+        shareable = not prefs and not exclude.strip()
+        response.headers["Cache-Control"] = _EDGE_FEED if shareable else _PRIVATE
         fp = prefs_from_json(prefs)
         now = datetime.now(timezone.utc)
         excl = {int(x) for x in exclude.split(",") if x.strip().lstrip("-").isdigit()}