GOPROXY caching for private modules: avoiding repeated downloads on a low-traffic service

I'm running a low-traffic Go service (Go 1.22 toolchain) that depends on a few modules hosted in a private Git repository. My current setting is the default GOPROXY=https://proxy.golang.org,direct, and GOPRIVATE covers the private repo path.

My understanding is that when the public proxy returns 404/410 for a private path, the toolchain falls back to direct mode, which means every clean build in CI re-downloads the module from the origin instead of hitting a cache. For a workload that rebuilds infrequently but from scratch each time, that adds network cost and latency I'd like to avoid.

What I can't pin down from the official documentation is the intended configuration boundary here: whether a self-hosted or authenticated proxy is expected to cache private modules, how authentication is supplied to it, and what cache invalidation semantics (if any) apply when a private module version is re-tagged or updated. The docs describe fallback behavior but not the caching contract for private paths.

1. Is there a documented, supported way to have a module proxy cache private modules with authentication, or is GOPRIVATE + direct fetching the only intended path?
2. If a private module is cached by a proxy, what invalidation behavior should I expect when the underlying tag moves?
3. Is there a reliable way to verify per-build whether a module came from the proxy cache versus a direct fetch?