test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r73_test.go

@@ -40,6 +40,9 @@ func (r *replayJWKCache) GetPublicKey(ctx context.Context, u, kid string, c *htt
 	}
 	return nil, fmt.Errorf("missing key %s", kid)
 }
+func (r *replayJWKCache) getPublicKeyFresh(ctx context.Context, u, kid string, c *http.Client) (crypto.PublicKey, error) {
+	return r.GetPublicKey(ctx, u, kid, c)
+}
 func (r *replayJWKCache) Clear()   {}
 func (r *replayJWKCache) Cleanup() {}
 func (r *replayJWKCache) Close()   {}