test: testify table-driven coverage for low-coverage branches

Lifts all 14 functions the operator flagged as <75% (measured at ed2119c)
to >=75%, using table-driven tests (require for fatals, assert for checks):

- limits.go: failPolicyGet (50.0% -> 100.0%)
- provider_gemini.go: httpClient (0.0% -> 100.0%)
- redis_store.go: get (71.4% -> 78.6%)
- resp.go: dialTimeoutFor, respDeadlineExceededErr.{Error,Timeout,Temporary},
  ensureConnLocked, getBatch (66.7-30.0% -> 91.3-100.0%)
- routes_media.go: resolveMediaRequest (50.0% -> 100.0%)
- routes_unified.go: unifiedCostMicros (66.7% -> 100.0%)
- translate_anthropic.go: isTruthy, toFloat64 (50.0/33.3% -> 100.0%)
- translate_gemini.go: geminiToolConfigFromOpenAI (66.7% -> 100.0%)

resp_test.go adds a hand-rolled fakeConn (net.Conn with injectable
Write/SetDeadline errors) to reach two respClient error branches a real
TCP connection cannot be coaxed into deterministically.

Total coverage: 90.7% -> 92.4% (no regression; report has the full
per-file table). Zero production-code changes. Existing tests untouched:
every diff is a pure addition of new test functions and their imports.

Gates: go test -count=1 (pass), -race (pass, 5x incl. an isolated
baseline-vs-branch comparison after one flaky run implicated pre-existing
registry_test.go timing tests this task never touched), gofmt/vet (clean),
golangci-lint incl. gosec and fieldalignment (0 issues), make yaegi-check
(OK), make integration (pass, untouched-green).

limits_test.go

@@ -6,6 +6,9 @@ import (
 	"math"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestLimiterRequestWindow is the brief's Step-1 case: a per-minute
@@ -632,3 +635,28 @@ func TestLimitsConfigValidate(t *testing.T) {
 		})
 	}
 }
+
+// TestLimiter_FailPolicyGet covers failPolicyGet's own fail-open/fail-closed
+// branching in isolation (storeGet's error/latched paths already drive it
+// indirectly elsewhere in this file): failOpen=true reads through to the
+// in-process fallback, failOpen=false refuses outright.
+func TestLimiter_FailPolicyGet(t *testing.T) {
+	cases := []struct {
+		name     string
+		failOpen bool
+		wantOK   bool
+	}{
+		{name: "failOpen true reads the fallback", failOpen: true, wantOK: true},
+		{name: "failOpen false refuses", failOpen: false, wantOK: false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			l := newLimiter(nil, c.failOpen)
+			v, ok := l.failPolicyGet("k")
+			require.Equal(t, c.wantOK, ok)
+			if c.wantOK {
+				assert.Equal(t, int64(0), v)
+			}
+		})
+	}
+}