Stale-while-error caching

Design the TTL and revalidation strategy for an API response cache in front of a slow, occasionally-flaky upstream (a 300ms third-party API that sometimes errors or times out). You want most responses served instantly from cache, freshness within ~60s, and, importantly, you'd rather serve slightly stale data than show users an error when the upstream is down. Design the caching/revalidation behavior to balance freshness, latency, and resilience.