fix: clear stuck pending state after stale refresh failures

[cursor]

Bug and impact

Two stale-while-revalidate bugs in @keyvhq/memoize caused incorrect caching behavior in production:

1. Stuck pending after background refresh failure — When a stale background revalidation failed, memoize left the in-flight pending entry set. Subsequent requests reused the failed promise and never retried the origin, serving stale data indefinitely even after the origin recovered.

2. Concurrent force bypass race — When a normal stale request and a ?force=true request arrived concurrently, they shared the same pending key. The force request could inherit the stale revalidation path and return stale data with X-Cache-Status: STALE instead of fresh data with BYPASS.

Root cause

@keyvhq/memoize@2.2.4 fixed sequential force bypass during SWR, but still:

• Cleared pending only on success in the stale fast-path .catch(), not on failure
• Used a single pending[key] for both forced and non-forced requests

Fix

Vendor memoize with three changes:

• Clear pending on stale background refresh failure
• Isolate pending keys by force flag (${key}:${forceExpiration})
• Defer fn() via Promise.resolve() so synchronous throws don't bypass the stale fast-path

Validation

• Added regression tests for both scenarios
• All 28 existing tests pass