fix(cache): harden cache backends, resilience, recovery, and transports

- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware
- global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager
- token-exchange retry, open-circuit rejections counted as failures
- TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)

internal/cache/backends/resp_test.go

@@ -142,7 +142,12 @@ func TestRESPReader_ReadError(t *testing.T) {
 			_, err := reader.ReadResponse()
 
 			require.Error(t, err)
-			assert.Equal(t, tt.expectedError, err.Error())
+			// R177: a '-' reply is now wrapped with ErrCommandReply so
+			// callers can tell a Redis command error (healthy connection)
+			// apart from an IO/parse error. The command's message text is
+			// preserved verbatim inside the wrapped error.
+			assert.True(t, errors.Is(err, ErrCommandReply), "want ErrCommandReply, got %v", err)
+			assert.Contains(t, err.Error(), tt.expectedError)
 		})
 	}
 }