fix(cache): harden cache backends, resilience, recovery, and transports

- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware
- global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager
- token-exchange retry, open-circuit rejections counted as failures
- TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)

internal/utils/review_r176_regression_test.go

@@ -0,0 +1,41 @@
+package utils
+
+import "testing"
+
+// TestR176_SanitizeForwardedHostRejectsPathDelimiters regresses
+// sanitizeForwardedHost: it previously only rejected control/whitespace
+// characters, so a crafted X-Forwarded-Host like "example.com/path" (or
+// with '?', '#', '@') survived and its delimiter was spliced verbatim into
+// the host part of a redirect URL (used as redirect_uri /
+// post_logout_redirect_uri and matched by the IdP). Valid host
+// characters — alphanumerics, '-', '.', ':', '[', ']' (port / IPv6) —
+// must still pass.
+func TestR176_SanitizeForwardedHostRejectsPathDelimiters(t *testing.T) {
+	valid := []string{
+		"example.com",
+		"example.com:8443",
+		"api.v2.example.co.uk",
+		"10.0.0.1",
+		"[2001:db8::1]",
+		"[fe80::1]:8080",
+	}
+	for _, in := range valid {
+		if got := sanitizeForwardedHost(in); got != in {
+			t.Fatalf("valid host %q was rejected: got %q", in, got)
+		}
+	}
+
+	invalid := []string{
+		"example.com/path", // path injection
+		"example.com?x=1",  // query injection
+		"example.com#frag", // fragment injection
+		"[email protected]", // userinfo injection
+		"example.com\\path",
+		"example.com /evil", // embedded space + path
+	}
+	for _, in := range invalid {
+		if got := sanitizeForwardedHost(in); got != "" {
+			t.Fatalf("host %q must be rejected (delimiter would poison the redirect base), got %q", in, got)
+		}
+	}
+}