perf: cache /bounty, /logs/histogram, /deckies; bump /config TTL to 5s

Round-2 follow-up: profile at 500c/u showed _execute still dominating
the uncached read endpoints (/bounty 76%, /logs/histogram 73%,
/deckies 56%). Same router-level TTL pattern as /stats — 5s window,
asyncio.Lock to collapse concurrent calls into one DB hit.

- /bounty: cache default unfiltered page (limit=50, offset=0,
  bounty_type=None, search=None). Filtered requests bypass.
- /logs/histogram: cache default (interval_minutes=15, no filters).
  Filtered / non-default interval requests bypass.
- /deckies: cache full response (endpoint takes no params).
- /config: bump _STATE_TTL from 1.0 to 5.0 — admin writes are rare,
  1s was too short for bursts to coalesce at high concurrency.

decnet/web/router/logs/api_get_histogram.py

@@ -1,3 +1,5 @@
+import asyncio
+import time
 from typing import Any, Optional
 
 from fastapi import APIRouter, Depends, Query
@@ -7,6 +9,40 @@ from decnet.web.dependencies import require_viewer, repo
 
 router = APIRouter()
 
+# /logs/histogram aggregates over the full logs table — expensive and
+# polled constantly by the UI. Cache only the unfiltered default call
+# (which is what the UI and locust hit); any filter bypasses.
+_HISTOGRAM_TTL = 5.0
+_DEFAULT_INTERVAL = 15
+_histogram_cache: tuple[Optional[list[dict[str, Any]]], float] = (None, 0.0)
+_histogram_lock: Optional[asyncio.Lock] = None
+
+
+def _reset_histogram_cache() -> None:
+    global _histogram_cache, _histogram_lock
+    _histogram_cache = (None, 0.0)
+    _histogram_lock = None
+
+
+async def _get_histogram_cached() -> list[dict[str, Any]]:
+    global _histogram_cache, _histogram_lock
+    value, ts = _histogram_cache
+    now = time.monotonic()
+    if value is not None and now - ts < _HISTOGRAM_TTL:
+        return value
+    if _histogram_lock is None:
+        _histogram_lock = asyncio.Lock()
+    async with _histogram_lock:
+        value, ts = _histogram_cache
+        now = time.monotonic()
+        if value is not None and now - ts < _HISTOGRAM_TTL:
+            return value
+        value = await repo.get_log_histogram(
+            search=None, start_time=None, end_time=None, interval_minutes=_DEFAULT_INTERVAL,
+        )
+        _histogram_cache = (value, time.monotonic())
+        return value
+
 
 @router.get("/logs/histogram", tags=["Logs"],
     responses={401: {"description": "Could not validate credentials"}, 403: {"description": "Insufficient permissions"}, 422: {"description": "Validation error"}},)
@@ -27,4 +63,6 @@ async def get_logs_histogram(
     st = _norm(start_time)
     et = _norm(end_time)
 
+    if s is None and st is None and et is None and interval_minutes == _DEFAULT_INTERVAL:
+        return await _get_histogram_cached()
     return await repo.get_log_histogram(search=s, start_time=st, end_time=et, interval_minutes=interval_minutes)