[filipeforattini]

Remote db.cache.* previously targeted HTTP routes that did not exist, while namespace flush required an operator endpoint. Expose the existing native Blob Cache through seven caller-authorized HTTP routes, and align both JavaScript transport mappings and policy types with the implemented contract.

Credentials determine the tenant partition; read/write roles and IAM policies apply to cache:<namespace>. Application namespaces cannot address the internal query-result cache. Values are bounded to 1 MiB and transported as base64. Cache state and invalidation remain node-local. Tag invalidation uses POST so literal keys such as tags stay usable. Prefix invalidation decodes URL query values before matching keys.

Adds route-level tests for binary values, expiry, invalidation, tenant isolation, IAM denial and invalid inputs. An actual server/remote-SDK regression now runs in the normal driver CI lane on each PR. Documents BigQuery cache-aside with ttl_ms: 600_000.

The security gate exposed advisories already present on main. Apply only the indicated rustls 0.23.46 and quinn-proto 0.11.18 patches in the three audited lockfiles, retaining the Node driver's newer quinn-proto.

Validation:

• Locked server cargo check and Clippy with warnings denied; formatting and diff checks.
• Four native cache HTTP route tests, 19 route-catalog tests, 11 route-discovery tests and six action-catalog tests passed. The four cache tests passed again after the prefix regression fix and dependency patches.
• Actual built red server plus remote JavaScript SDK passed binary roundtrip, ten-minute TTL acceptance, short expiry and every invalidation method, including encoded keys/namespaces/prefixes and canonical /v1 aliases.
• Remote-client suite: 195 passed, 2 existing skips. Focused cache SDK suites: 23 passed.
• Workspace, Python-driver and Node-addon cargo audit with warnings denied: all passed.
• Build workflow and CI contract tests, generated SQL reference and documentation matrix passed; standalone driver locked metadata resolves.