review fixes apr 2026 (#130)

* Multiple fixes

- refresh coordinator dedup + memory pressure wire
- middleware sse consolidation + timer leak + claim cache
- universal cache sync backfill + isDebug gate
- lazy background task race
- memory monitor stw cached + refresh() api

* fix(auth): suppress OIDC redirects on non-navigation requests

- [x] Add isNonNavigationRequest using Sec-Fetch-Mode and Accept headers
- [x] Add comprehensive TestIsNonNavigationRequest
- [x] Update ServeHTTP to 401 non-navigation and AJAX requests

Fixes #129

* feat(config): add custom CA and insecure skip verify for OIDC TLS

- [x] Add CACertPath, CACertPEM, InsecureSkipVerify to Config
- [x] Implement loadCACertPool for CA bundle loading
- [x] Update HTTPClientConfig with RootCAs and InsecureSkipVerify
- [x] Apply CA pool and skip verify to pooled HTTP clients
- [x] Enhance configKey to distinguish TLS configs
- [x] Add comprehensive ca_cert_test.go

Fixes #125

* feat(oidc): add custom CA certificate support for private OIDC providers

- [x] Add caCertPath, caCertPEM, insecureSkipVerify config options
- [x] Update traefik.yml with new OIDC client config fields
- [x] Add configuration schema descriptions for new options
- [x] Update README table and add Custom CA Certificates section

* Fix the documentation.

* test(redis): add oversized argument rejection test

- [x] Add TestRedisConn_RejectOversizedArgumentBytes
- [x] Import strings package

* Dependencies cleanup

vendor/github.com/redis/go-redis/v9/internal/pool/conn_state.go

@@ -13,12 +13,11 @@ import (
 // States are designed to be lightweight and fast to check.
 //
 // State Transitions:
-//
-//	CREATED → INITIALIZING → IDLE ⇄ IN_USE
-//	                           ↓
-//	                       UNUSABLE (handoff/reauth)
-//	                           ↓
-//	                        IDLE/CLOSED
+//   CREATED → INITIALIZING → IDLE ⇄ IN_USE
+//                              ↓
+//                          UNUSABLE (handoff/reauth)
+//                              ↓
+//                           IDLE/CLOSED
 type ConnState uint32
 
 const (
@@ -121,7 +120,7 @@ type ConnStateMachine struct {
 
 	// FIFO queue for waiters - only locked during waiter add/remove/notify
 	mu          sync.Mutex
-	waiters     *list.List   // List of *waiter
+	waiters     *list.List // List of *waiter
 	waiterCount atomic.Int32 // Fast lock-free check for waiters (avoids mutex in hot path)
 }
 
@@ -341,3 +340,4 @@ func (sm *ConnStateMachine) notifyWaiters() {
 		}
 	}
 }
+

vendor/github.com/redis/go-redis/v9/internal/semaphore.go

@@ -190,4 +190,4 @@ func (s *FIFOSemaphore) Close() {
 // Len returns the current number of acquired tokens.
 func (s *FIFOSemaphore) Len() int32 {
 	return s.max - int32(len(s.tokens))
-}
+}