fix: bound the kuri-bind reflective plan/scan caches - #141

Summary

• PlanCompiler.plans and KotlinReflectMemberScanner.scanCache were unbounded ConcurrentHashMap<KClass<*>, ...> instances living inside the process-lifetime KuriBind.executor singleton. A KClass strongly retains its backing Class and, through it, its ClassLoader, so every distinct type ever bound (including nested value types routed through runtimeValueIsBindable) stayed cached, pinning its ClassLoader, for the life of the process.
• Added BoundedCache, a small thread-safe LRU (a single access-ordered LinkedHashMap guarded by a ReentrantLock), and switched both caches onto it with a 2048-entry default, evicting the least-recently-used entry once the cap is reached.
• A weak-key map was the first design considered, but doesn't actually solve this: TypePlan stores its KClass directly, and ScannedMember's reader closures hold kotlin-reflect KProperty1 instances that reference their declaring class, so the cached value keeps the key (and its ClassLoader) strongly reachable regardless of how the map's key reference is held. A bounded LRU sidesteps that entirely.

Test plan

• ./gradlew :kuri-bind:jvmTest — new BoundedCacheTest (size-bound eviction, LRU-order eviction, cache-hit identity, concurrent-miss convergence), PlanCompilerCacheTest, and MemberScannerCacheTest (both prove a type evicted by newer lookups is recompiled rather than retained forever), plus the full existing kuri-bind suite
• ./gradlew :kuri-bind:ktlintCheck
• ./gradlew :kuri-bind:detekt
• ./gradlew :kuri-bind:apiCheck — no public API surface changed (BoundedCache is internal; the new constructor parameters on PlanCompiler/KotlinReflectMemberScanner are internal-only and default-valued), so no apiDump needed
• kuri-bind only targets jvm, so jsNodeTest/wasmJsNodeTest don't apply to this module

Closes #89