Audit review (rounds 1-31): fix confirmed issues, remove dead code, harden tests

Security/correctness fixes:
- fail-open token validation preserved with lenient-audience; access token that
  fails verification and has no ID token to corroborate now fails closed
- token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h)
- constant-time OAuth state compare; clear state/nonce/code_verifier on
  callback token-exchange failure to prevent replay of half-failed flows
- StopAllTasks gated on last-instance close
- background-task panic recovery; remove task-registry counter leak
- circuit breaker half-open: release probe slot; CB + per-session outcome
  recorded once per refresh operation, not once per waiter
- Redis connection pool: handle nil receive when pool closed concurrently
- FileStore: atomic temp-write + rename
- errors_recovery health-check data race -> atomic

Test-isolation / hardening:
- reset helpers for Once-pinned global cache manager and transport pool
- coverage: utils 70->93% (redirect URL security contract); fuzz targets for
  bearer parsers; concurrent ServeHTTP race tests for the shared request path

Dead-code removal (verified orphaned, build+suite green): internal/providers
(30 files, 0 importers), internal/compat, internal/features, input_validation.

Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+
linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.

utilities.go

@@ -240,7 +240,8 @@ func (t *TraefikOidc) Close() error {
 		// instance. Only stop it when the LAST instance is shutting down;
 		// otherwise one instance's teardown (e.g. a single config reload) would
 		// kill chunked-session/token cleanup for all surviving instances (rank 12).
-		if unregisterLiveInstance() <= 0 {
+		lastInstance := unregisterLiveInstance() <= 0
+		if lastInstance {
 			_ = rm.StopBackgroundTask("singleton-token-cleanup") // best effort, last instance only
 		}
 		// Stop metadata refresh task using same hash-based name as startMetadataRefresh
@@ -343,10 +344,17 @@ func (t *TraefikOidc) Close() error {
 			t.safeLogDebug("Error recovery manager graceful degradation closed")
 		}
 
-		// Stop all global background tasks
-		taskRegistry := GetGlobalTaskRegistry()
-		taskRegistry.StopAllTasks()
-		t.safeLogDebug("All global background tasks stopped")
+		// Stop all process-global background tasks, but ONLY when the last
+		// instance is shutting down. The global TaskRegistry holds shared
+		// singleton tasks (singleton-token-cleanup, singleton-metadata-refresh-*,
+		// memory-monitor); stopping them on any single instance's Close (e.g. one
+		// config reload) would kill cleanup for all surviving instances — the same
+		// rationale as the targeted StopBackgroundTask above.
+		if lastInstance {
+			taskRegistry := GetGlobalTaskRegistry()
+			taskRegistry.StopAllTasks()
+			t.safeLogDebug("All global background tasks stopped")
+		}
 
 		// Note: Centralized pool in internal/pool is singleton-managed and doesn't require explicit cleanup
 		t.safeLogDebug("Memory pools managed by singleton pattern")