test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

main_initialization_test.go

@@ -135,7 +135,8 @@ func TestInitializeMetadata(t *testing.T) {
 							"issuer":                 srv.URL,
 							"authorization_endpoint": srv.URL + "/auth",
 							"token_endpoint":         srv.URL + "/token",
-							// Missing jwks_uri, revocation_endpoint, end_session_endpoint
+							"jwks_uri":               srv.URL + "/jwks",
+							// Missing revocation_endpoint, end_session_endpoint (both optional)
 						})
 					}
 				}))