fix(cache): harden cache backends, resilience, recovery, and transports

- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware
- global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager
- token-exchange retry, open-circuit rejections counted as failures
- TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)

internal/recovery/metrics_test.go

@@ -4,6 +4,7 @@ package recovery
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -720,6 +721,16 @@ func TestRecoveryMetrics_HTTPMetricsHandler(t *testing.T) {
 	if body == "" {
 		t.Error("Expected non-empty response body")
 	}
+
+	// Body must be valid JSON (R147): the handler previously declared
+	// Content-Type: application/json but wrote Go map syntax via fmt.
+	var decoded map[string]any
+	if err := json.Unmarshal([]byte(body), &decoded); err != nil {
+		t.Errorf("metrics body is not valid JSON: %v (body: %s)", err, body)
+	}
+	if _, ok := decoded["metrics"]; !ok {
+		t.Errorf("metrics JSON body must contain a \"metrics\" key, got: %s", body)
+	}
 }
 
 // =============================================================================