Audit review (rounds 1-31): fix confirmed issues, remove dead code, harden tests

Security/correctness fixes:
- fail-open token validation preserved with lenient-audience; access token that
  fails verification and has no ID token to corroborate now fails closed
- token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h)
- constant-time OAuth state compare; clear state/nonce/code_verifier on
  callback token-exchange failure to prevent replay of half-failed flows
- StopAllTasks gated on last-instance close
- background-task panic recovery; remove task-registry counter leak
- circuit breaker half-open: release probe slot; CB + per-session outcome
  recorded once per refresh operation, not once per waiter
- Redis connection pool: handle nil receive when pool closed concurrently
- FileStore: atomic temp-write + rename
- errors_recovery health-check data race -> atomic

Test-isolation / hardening:
- reset helpers for Once-pinned global cache manager and transport pool
- coverage: utils 70->93% (redirect URL security contract); fuzz targets for
  bearer parsers; concurrent ServeHTTP race tests for the shared request path

Dead-code removal (verified orphaned, build+suite green): internal/providers
(30 files, 0 importers), internal/compat, internal/features, input_validation.

Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+
linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.

bearer_auth_fuzz_test.go

@@ -0,0 +1,46 @@
+package traefikoidc
+
+import "testing"
+
+// FuzzParseBearerJOSEHeader verifies the attacker-controlled JWT header parser
+// never panics on arbitrary input (no slice OOB, no unbounded alloc, no
+// JSON-engine surprise) regardless of token contents.
+func FuzzParseBearerJOSEHeader(f *testing.F) {
+	seeds := []string{
+		"",
+		"...",
+		"abc.def.ghi",
+		"eyJhbGciOiJSUzI1NiIsImtpZCI6ImtpZDEifQ.sig.sig", // alg=RS256 kid=kid1
+		"::",
+		"snapshot=",
+		"a,b.zzz",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+	f.Fuzz(func(t *testing.T, token string) {
+		parseBearerJOSEHeader(token) // must not panic
+	})
+}
+
+// FuzzSanitizeBearerIdentifier verifies the identifier sanitizer never panics on
+// arbitrary strings and always returns either a clean value or a *bearerError.
+func FuzzSanitizeBearerIdentifier(f *testing.F) {
+	seeds := []string{
+		"",
+		"alice",
+		"user,group=admin",
+		"a\u202eb\u202c",
+		"\t \n",
+		"verylongidentifier-padding-padding-padding-padding",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+	f.Fuzz(func(t *testing.T, raw string) {
+		id, berr := sanitizeBearerIdentifier(raw, 256)
+		if berr == nil && id == "" {
+			t.Fatalf("sanitize ok but empty identifier for %q", raw)
+		}
+	})
+}