test: v0.2 integration coverage

Extends the integration suite (task 5) to exercise retry, cache, images/audio, and admin under real Traefik+Yaegi:

- mock/main.go: a /flaky/v1/chat/completions endpoint failing the first
  request per process with 503 then succeeding (atomic counter, response
  carries mock_attempt for verification); /v1/images/generations returning
  a canned OpenAI images response; /v1/audio/speech returning binary bytes
  under audio/mpeg; gemini mode's :predict returning canned Imagen
  predictions.
- dynamic.yml.tmpl: retry{enabled:true,attempts:1}, cache{enabled:true,
  ttl:2m}, admin{enabled:true}; a flaky provider pointed at the new mock
  endpoint; an admin:true inline user; alice and admin both given a
  generous-but-real per-user limits block so their own request counters
  are trackable via the usage API.
- integration_test.go: TestRetryFlakyRecovers (client 200, exactly two
  upstream hits proven via mock_attempt), TestResponseCache (miss then
  hit, tokensPerDay unchanged across the hit via the admin usage API),
  TestImagesGenerations (openai native forward + gemini Imagen
  translation), TestAudioSpeech (binary round trip, Content-Type
  forwarded), TestAdminDashboard (unauthenticated shell, admin vs
  non-admin gate, usage reflecting this suite's own traffic).

make integration exits 0 (verified across multiple fresh runs).

integration/traefik/dynamic.yml.tmpl

@@ -44,6 +44,19 @@ http:
               baseUrl: "http://mockgemini:8080"
               apiKey: "mock-gemini-key"
               models: ["gemini-mock"]
+            # Backs test 8's retry coverage only: baseUrl points at the
+            # SAME mockopenai container, under its dedicated /flaky prefix
+            # (see integration/mock/main.go's handleFlakyOpenAIChat), so
+            # a.baseURL+"/v1/chat/completions" (provider_openai.go)
+            # resolves to /flaky/v1/chat/completions. discovery is left
+            # off — GET /flaky/v1/models isn't served — so the explicit
+            # "flaky-mock" model id below is the only way this provider's
+            # model is known.
+            flaky:
+              type: openai
+              baseUrl: "http://mockopenai:8080/flaky"
+              apiKey: "mock-openai-key"
+              models: ["flaky-mock"]
           groups:
             eng:
               limits:
@@ -53,15 +66,47 @@ http:
                 requestsPerMinute: 3
           users:
             inline:
+              # limits.requestsPerDay is set (generously — every test in
+              # this suite together never approaches it) purely so
+              # buildLimitScopes (routes_unified.go/routes_media.go/
+              # admin.go) builds a "user" counter scope for alice at all:
+              # a nil per-user Limits means only the group's own counters
+              # ever increment, which would make the admin usage test's
+              # "alice's own request counters are > 0" assertion always
+              # read zero regardless of how much traffic she generated.
               - name: alice
                 group: eng
                 apiKey: "sk-int-alice"
+                limits:
+                  requestsPerDay: 1000000
+              # Admin-flagged user for the admin dashboard integration
+              # coverage (spec §4, v0.2): same "eng" group as alice, so
+              # polling /admin/api/* repeatedly never hits a rate limit
+              # meant for a different scenario. limits.requestsPerDay is
+              # set for the same reason as alice's above.
+              - name: admin
+                group: eng
+                apiKey: "sk-int-admin"
+                admin: true
+                limits:
+                  requestsPerDay: 1000000
             file: "/users/users.json"
           redis:
             address: "redis:6379"
           mcpServers:
             tool:
               url: "http://mocktool:8080"
+          # v0.2 features (spec §1, §2, §4), all opt-in and off by default
+          # in v0.1: enabled here so the integration suite exercises every
+          # one under real Traefik+Yaegi, not just go test.
+          retry:
+            enabled: true
+            attempts: 1 # one retry after the first try — matches handleFlakyOpenAIChat's single forced 503
+          cache:
+            enabled: true
+            ttl: "2m"
+          admin:
+            enabled: true
 
     # Second, separate middleware instance carrying only the optional
     # real-upstream smoke test's "uni" provider (task 7, INTEGRATION_REAL=1