Merge main into 0.8.0-redis: resolve conflicts

Merged the following features from main:
- Dynamic Client Registration (RFC 7591)
- Sharded cache and CPU spike prevention
- Documentation updates (CNAME, index.html)

Resolved conflicts in:
- settings.go: Combined Redis config with Dynamic Client Registration config
- universal_cache_singleton.go: Merged Redis backend support with consolidated cleanup

Both features now work together:
- Redis distributed caching with circuit breaker and health checks
- Consolidated cleanup goroutine (reduces from 7 to 1)
- SkipAutoCleanup flag honored for all cache types

main_test.go

@@ -3216,10 +3216,8 @@ func TestAuthenticationFlowReplayDetection(t *testing.T) {
 		t.Fatalf("Initial authentication should succeed: %v", err)
 	}
 
-	// Verify JTI is in cache
-	replayCacheMu.Lock()
-	_, exists := replayCache.Get(jti)
-	replayCacheMu.Unlock()
+	// Verify JTI is in cache (use shardedReplayCache which is the actual cache used)
+	exists := shardedReplayCache.Exists(jti)
 	if !exists {
 		t.Error("JTI should be added to replay cache during initial authentication")
 	}
@@ -3400,14 +3398,12 @@ func TestConcurrentTokenValidation(t *testing.T) {
 		t.Errorf("Expected no errors in concurrent validation, got %d errors: %v", len(errors), errors)
 	}
 
-	// Verify all JTIs are in cache
-	replayCacheMu.Lock()
+	// Verify all JTIs are in cache (use shardedReplayCache which is the actual cache used)
 	for i, jti := range jtis {
-		if _, exists := replayCache.Get(jti); !exists {
+		if !shardedReplayCache.Exists(jti) {
 			t.Errorf("JTI %d (%s) should be in replay cache", i, jti)
 		}
 	}
-	replayCacheMu.Unlock()
 }
 
 // TestJTIBlacklistBehavior tests the JTI blacklist cache management
@@ -3460,9 +3456,8 @@ func TestJTIBlacklistBehavior(t *testing.T) {
 		{
 			name: "JTI exists in blacklist after verification",
 			action: func() error {
-				replayCacheMu.RLock()
-				defer replayCacheMu.RUnlock()
-				if _, exists := replayCache.Get(jti); !exists {
+				// Use shardedReplayCache which is the actual cache used
+				if !shardedReplayCache.Exists(jti) {
 					return fmt.Errorf("JTI not found in blacklist cache")
 				}
 				return nil
@@ -3569,9 +3564,8 @@ func TestSessionBasedTokenRevalidation(t *testing.T) {
 	}
 
 	// Check replay cache
-	replayCacheMu.Lock()
-	_, inReplayCache := replayCache.Get(jti)
-	replayCacheMu.Unlock()
+	// Use shardedReplayCache which is the actual cache used
+	inReplayCache := shardedReplayCache.Exists(jti)
 	if !inReplayCache {
 		t.Error("JTI should be in replay cache")
 	}