fix(config): wire introspectionURL override and repair dead endpoint overrides (#152)

Issue #152 asks for a manual introspection endpoint because some IdPs
omit introspection_endpoint from discovery. Analysis found the two
documented overrides revocationURL and oidcEndSessionURL were dead
code: the 1b49e13 rebuild dropped their constructor wiring.

Add the IntrospectionURL config field and wire all three overrides.
The overrides apply inside updateMetadataEndpoints, so they survive
every metadata refresh. A manual value always wins over discovery.
The constructor also seeds the live fields, so a failed discovery
does not lose operator configuration.

Manual values skip the poisoned-discovery defences on purpose. They
sit at the same trust tier as providerURL and isValidSecureURL gates
them at config time.

Add issue152_regression_test.go: 8 tests pin precedence, refresh
survival, cold-start seeding, end-to-end introspection over HTTP,
and the validation contract.

types.go

@@ -161,23 +161,33 @@ type TraefikOidc struct {
 	clientAuthMethod             string
 	clientAssertion              *ClientAssertionSigner
 	registrationURL              string
-	backchannelLogoutPath        string
-	frontchannelLogoutPath       string
-	scopesSupported              []string
-	scopes                       []string
-	extraAuthParams              map[string]string
-	refreshGracePeriod           time.Duration
-	maxRefreshTokenAge           time.Duration
-	metadataMu                   sync.RWMutex
-	shutdownOnce                 sync.Once
-	sessionInvalidationCache     CacheInterface
-	refreshResultCache           CacheInterface
-	minimalHeaders               bool
-	stripAuthCookies             bool
-	enableBackchannelLogout      bool
-	enableFrontchannelLogout     bool
-	requireTokenIntrospection    bool
-	allowPrivateIPAddresses      bool
+	// configRevocationURL, configEndSessionURL, and configIntrospectionURL
+	// hold operator-configured endpoint overrides (Config.RevocationURL,
+	// Config.OIDCEndSessionURL, Config.IntrospectionURL). They are set once at
+	// construction and never mutated afterwards, so they are read lock-free,
+	// the same contract as providerURL, which updateMetadataEndpoints already
+	// reads unlocked. A manual override always wins over discovery; an empty
+	// string means use the discovered value.
+	configRevocationURL       string
+	configEndSessionURL       string
+	configIntrospectionURL    string
+	backchannelLogoutPath     string
+	frontchannelLogoutPath    string
+	scopesSupported           []string
+	scopes                    []string
+	extraAuthParams           map[string]string
+	refreshGracePeriod        time.Duration
+	maxRefreshTokenAge        time.Duration
+	metadataMu                sync.RWMutex
+	shutdownOnce              sync.Once
+	sessionInvalidationCache  CacheInterface
+	refreshResultCache        CacheInterface
+	minimalHeaders            bool
+	stripAuthCookies          bool
+	enableBackchannelLogout   bool
+	enableFrontchannelLogout  bool
+	requireTokenIntrospection bool
+	allowPrivateIPAddresses   bool
 	// allowLoopbackHosts permits loopback/localhost hosts in outbound URL
 	// validation (validateHost). Derived at construction time from a loopback
 	// providerURL (local development), never operator-set directly. Mirrors