Return whether a capability lookup would need a fresh B2 authorize request.
Parameters
cacheKey: string
Exact capability cache key to inspect.
now: number = ...
Millisecond timestamp used for deterministic tests.
Returns boolean
True when no fresh cache entry or in-flight lookup exists.
Remarks
HTTP uses this to put only actual capability-authorize work behind shared
verification limits. This inspects only the requested key and leaves global
cleanup to normal fetch and idle sweeps.
Return whether a capability lookup would need a fresh B2 authorize request.