perf: cache public catalog responses

apps/api/app/main.py

@@ -35,6 +35,15 @@ app.add_middleware(
     allow_headers=["Authorization", "Content-Type"],
 )
 
+PUBLIC_CATALOG_CACHE_CONTROL = "public, max-age=60, stale-while-revalidate=60"
+
+
+def _is_public_catalog_path(path: str) -> bool:
+    return path in {
+        "/api/v1/fishes", "/api/v1/waterbodies", "/api/v1/baits",
+        "/api/v1/tackle/items", "/api/v1/tackle/rigs",
+    } or path.startswith(("/api/v1/tackle/items/", "/api/v1/tackle/rigs/"))
+
 
 @app.middleware("http")
 async def structured_request_log(request: Request, call_next):
@@ -52,6 +61,8 @@ async def structured_request_log(request: Request, call_next):
         response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
         if request.url.path.startswith("/api/v1/admin/") or request.url.path == "/api/v1/catch-reports":
             response.headers["Cache-Control"] = "no-store"
+        elif request.method == "GET" and response.status_code == 200 and _is_public_catalog_path(request.url.path):
+            response.headers["Cache-Control"] = PUBLIC_CATALOG_CACHE_CONTROL
         if settings.deployment_environment == "production":
             response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
         return response

apps/api/tests/test_api.py

@@ -74,6 +74,7 @@ def test_explicit_source_conflict_is_exposed_on_activity_and_spot() -> None:
 def test_waterbody_catalog_exposes_nullable_source_provenance() -> None:
     response = client.get("/api/v1/waterbodies")
     assert response.status_code == 200
+    assert response.headers["cache-control"] == "public, max-age=60, stale-while-revalidate=60"
     item = next(row for row in response.json() if row["slug"] == "test-lake")
     assert item["source_system"] is None
     assert item["source_external_id"] is None