Perf: parallelize admin loads + edge-cache /api/brief

Two concrete latency wins found by measuring (server compute is 2-17ms; the time
is in the path, not the box):
- Admin panel fired its 6 API calls SEQUENTIALLY (await chain) — so it paid the
  uncached origin round-trip six times back-to-back. Now one Promise.all batch.
  This is the admin lag.
- /api/brief (the home "Gathering the good news…" content) wasn't edge-cached, so
  a distant anonymous visitor triggered a Cloudflare→residential-origin pull.
  Same global/shareable boundary as /api/feed: public s-maxage=45 when no
  prefs/exclude, else private,no-store. (Needs /api/brief added to the CF cache
  rule path list to take effect at the edge.)

Tests: test_brief_cache_boundary. 228 pytest + 11 vitest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_api.py

@@ -107,3 +107,10 @@ def test_feed_cache_boundary(client):
     assert client.get("/api/feed", params={"following": "true"}).headers.get("cache-control") == "private, no-store"
     assert client.get("/api/feed", params={"prefs": json.dumps({"mute_topics": ["science"]})}).headers.get("cache-control") == "private, no-store"
     assert client.get("/api/feed", params={"exclude": "1,2"}).headers.get("cache-control") == "private, no-store"
+
+
+def test_brief_cache_boundary(client):
+    # Default highlights are global → public; personal filters → private.
+    assert "public" in client.get("/api/brief").headers.get("cache-control", "")
+    assert client.get("/api/brief", params={"prefs": json.dumps({"mute_topics": ["health"]})}).headers.get("cache-control") == "private, no-store"
+    assert client.get("/api/brief", params={"exclude": "3"}).headers.get("cache-control") == "private, no-store"