test: integration suite with real Traefik, redis-shared limits, streaming assertions

Adds integration/ (separate module): docker compose stack with real Traefik
v3.5 + localPlugins, mock openai/anthropic/gemini/tool providers, shared
Redis, and a raw-TCP streaming timing probe. 6/7 tests pass; streaming
incrementality fails on a confirmed external yaegi/Traefik bug (see
task-15-report.md), not a plugin defect.

Fixes 4 real Yaegi-interpretation bugs surfaced by running the plugin under
real Traefik for the first time (none caught by go test or yaegi-check,
which never exercises chat/embeddings/streaming/Redis):

- .traefik.yml: add basePkg (Traefik derives the yaegi binding identifier
  from the module path, not the package's own declared name; without this
  override the plugin never loads at all).
- registry.go: resolveAgainst's multi-value return panicked yaegi on an
  inline string concatenation; assign to a local first.
- routes_unified.go: errors.As panicked yaegi on interpreted pointer error
  types; use plain type assertions (both types are always returned bare,
  never wrapped).
- sse.go: readSSE's dispatch closure hit the same multi-value-assignment
  panic as registry.go; split into separate statements.
- resp.go: respErr as a defined string type was indistinguishable from a
  plain string in a yaegi type assertion, misreading every successful
  Redis SELECT reply as failed and silently disabling rate limiting;
  changed to a struct.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test lint yaegi-check integration
+.PHONY: test lint yaegi-check integration integration-keep integration-up integration-wait integration-down
 
 test:
 	go test ./... -count=1
@@ -15,5 +15,38 @@ lint:
 yaegi-check:
 	cd tools/yaegi-check && GOWORK=off go run . $(CURDIR)
 
-integration:
-	@echo "integration: placeholder until Task 15"
+INTEGRATION_COMPOSE := integration/docker-compose.yml
+INTEGRATION_HEALTH_URL := http://localhost:19081/v1/models
+INTEGRATION_ALICE_KEY := sk-int-alice
+
+integration-up:
+	docker compose -f $(INTEGRATION_COMPOSE) up -d --build
+
+integration-wait:
+	@i=0; \
+	until curl -sf -o /dev/null -H "Authorization: Bearer $(INTEGRATION_ALICE_KEY)" $(INTEGRATION_HEALTH_URL); do \
+		i=$$((i+1)); \
+		if [ $$i -ge 120 ]; then \
+			echo "integration: traefik1 did not become healthy within 120s"; \
+			docker compose -f $(INTEGRATION_COMPOSE) logs traefik1; \
+			exit 1; \
+		fi; \
+		sleep 1; \
+	done
+
+integration-down:
+	docker compose -f $(INTEGRATION_COMPOSE) down -v
+
+# integration brings the stack up, waits for it to answer, runs the suite,
+# then always tears the stack down (pass or fail) so the exit code
+# reflects the tests alone.
+integration: integration-up integration-wait
+	@go -C integration test -tags integration -count=1 ./...; status=$$?; \
+	$(MAKE) integration-down; \
+	exit $$status
+
+# integration-keep is the debugging variant: same run, but leaves the
+# compose stack up afterward for inspecting logs/state by hand. Tear it
+# down yourself with `make integration-down` when done.
+integration-keep: integration-up integration-wait
+	go -C integration test -tags integration -count=1 ./...