fix: ensure negative cache results are stored in TrustHosts middleware

Problem:
- Cache::remember() does not cache null return values
- When no FQDN was configured, the closure returned null
- This caused DB queries on every request, defeating the cache

Solution:
- Use empty string ('') as sentinel value instead of null
- Convert sentinel back to null after retrieving from cache
- Now both positive and negative results are cached properly

Changes:
- Return empty string from closure instead of null
- Add explicit sentinel-to-null conversion after cache retrieval
- Add test to verify negative caching works correctly

This ensures zero DB queries even when FQDN is not configured.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/Http/Middleware/TrustHosts.php

@@ -19,6 +19,7 @@ class TrustHosts extends Middleware
         $trustedHosts = [];
 
         // Trust the configured FQDN from InstanceSettings (cached to avoid DB query on every request)
+        // Use empty string as sentinel value instead of null so negative results are cached
         $fqdnHost = Cache::remember('instance_settings_fqdn_host', 300, function () {
             try {
                 $settings = InstanceSettings::get();
@@ -26,16 +27,19 @@ class TrustHosts extends Middleware
                     $url = Url::fromString($settings->fqdn);
                     $host = $url->getHost();
 
-                    return $host ?: null;
+                    return $host ?: '';
                 }
             } catch (\Exception $e) {
                 // If instance settings table doesn't exist yet (during installation),
-                // return null to fall back to APP_URL only
+                // return empty string (sentinel) so this result is cached
             }
 
-            return null;
+            return '';
         });
 
+        // Convert sentinel value back to null for consumption
+        $fqdnHost = $fqdnHost !== '' ? $fqdnHost : null;
+
         if ($fqdnHost) {
             $trustedHosts[] = $fqdnHost;
         }