feat(17-01): build mimecast-blast-radius.ts fan-out orchestration

- Add getBlastRadius(): never-throwing orchestration that fans out to
  searchDeliveredMessages + getHeldMessages + getThreatEvents (D-01,
  unconditional fan-out) and merges into normalized matched/delivered/
  held/rejected/clicked counts + perRecipient status array
- Config gate (BLAST-02): returns status:'unavailable' reason:'not_configured'
  synchronously when Mimecast is unconfigured, never constructs the client
- Redis-backed 5-min cache (D-04) via redis-client.ts, short-circuits before
  any MimecastClient call on hit
- clicked derived best-effort from getThreatEvents() analysis[] (D-02);
  documents the /api/ttp/url/get-logs limitation in code
- Documents D-05 known limitation: single global getMimecastClient() only,
  not per-company mimecast_tenants
- Unrecognized delivered-message status strings treated conservatively as
  non-rejected (A3 unconfirmed enum), raw values logged at debug level
- Add lib/services/mimecast-blast-radius.test.ts covering config gate,
  cache-hit short-circuit, fan-out merge, never-throw-on-error, and
  unknown-recipient classification
- Log pre-existing unrelated itglue-search.test.ts failures to
  deferred-items.md (out of scope for this plan)

.planning/phases/17-mimecast-blast-radius-lookup/deferred-items.md

@@ -0,0 +1,21 @@
+# Deferred Items — Phase 17, Plan 01
+
+Out-of-scope discoveries found during execution. Not fixed per SCOPE BOUNDARY
+(only auto-fix issues directly caused by the current task's changes).
+
+## Pre-existing test failures unrelated to this plan
+
+`npm test` (full suite) shows 2 pre-existing failures in
+`lib/services/analyzer/itglue-search.test.ts`:
+
+- `itglueSearch > returns capped, redacted doc snippets when the org is found`
+- `itglueSearch > tolerates per-call failures (configurations errors, flex still returns)`
+
+Both fail with a `client.getFlexibleAssetsForOrganization is not a function`
+stderr log and count-mismatch assertions. Neither `lib/services/analyzer/
+itglue-search.ts` nor its test file was touched by Phase 17 Plan 01 (which only
+modified `lib/services/mimecast-client.ts` and added
+`lib/services/mimecast-blast-radius.ts` + their test files). Last commit
+touching those files: `a0a6e7f fix(itglue): list flexible assets per type to
+satisfy API 422 requirement` — predates this plan's work. Left unfixed; not
+in scope for Phase 17.