Audit review (rounds 1-31): fix confirmed issues, remove dead code, harden tests

Security/correctness fixes:
- fail-open token validation preserved with lenient-audience; access token that
  fails verification and has no ID token to corroborate now fails closed
- token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h)
- constant-time OAuth state compare; clear state/nonce/code_verifier on
  callback token-exchange failure to prevent replay of half-failed flows
- StopAllTasks gated on last-instance close
- background-task panic recovery; remove task-registry counter leak
- circuit breaker half-open: release probe slot; CB + per-session outcome
  recorded once per refresh operation, not once per waiter
- Redis connection pool: handle nil receive when pool closed concurrently
- FileStore: atomic temp-write + rename
- errors_recovery health-check data race -> atomic

Test-isolation / hardening:
- reset helpers for Once-pinned global cache manager and transport pool
- coverage: utils 70->93% (redirect URL security contract); fuzz targets for
  bearer parsers; concurrent ServeHTTP race tests for the shared request path

Dead-code removal (verified orphaned, build+suite green): internal/providers
(30 files, 0 importers), internal/compat, internal/features, input_validation.

Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+
linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.

settings.go

@@ -1159,6 +1159,41 @@ func (rc *RedisConfig) ApplyEnvFallbacks() {
 			}
 		}
 	}
+
+	// Resilience fallbacks documented in examples/redis-config.yaml. These were
+	// previously absent: an operator following the documented env var names got
+	// no effect. Match the bool/numeric patterns used above.
+	if !rc.EnableCircuitBreaker {
+		if env := os.Getenv("REDIS_ENABLE_CIRCUIT_BREAKER"); env == "true" || env == "1" {
+			rc.EnableCircuitBreaker = true
+		}
+	}
+	if rc.CircuitBreakerThreshold == 0 {
+		if s := os.Getenv("REDIS_CIRCUIT_BREAKER_THRESHOLD"); s != "" {
+			if v, err := strconv.Atoi(s); err == nil && v > 0 {
+				rc.CircuitBreakerThreshold = v
+			}
+		}
+	}
+	if rc.CircuitBreakerTimeout == 0 {
+		if s := os.Getenv("REDIS_CIRCUIT_BREAKER_TIMEOUT"); s != "" {
+			if v, err := strconv.Atoi(s); err == nil && v > 0 {
+				rc.CircuitBreakerTimeout = v
+			}
+		}
+	}
+	if !rc.EnableHealthCheck {
+		if env := os.Getenv("REDIS_ENABLE_HEALTH_CHECK"); env == "true" || env == "1" {
+			rc.EnableHealthCheck = true
+		}
+	}
+	if rc.HealthCheckInterval == 0 {
+		if s := os.Getenv("REDIS_HEALTH_CHECK_INTERVAL"); s != "" {
+			if v, err := strconv.Atoi(s); err == nil && v > 0 {
+				rc.HealthCheckInterval = v
+			}
+		}
+	}
 }
 
 func isOriginAllowed(origin string, allowedOrigins []string) bool {