Merge main into 0.8.0-redis: resolve conflicts

Merged the following features from main:
- Dynamic Client Registration (RFC 7591)
- Sharded cache and CPU spike prevention
- Documentation updates (CNAME, index.html)

Resolved conflicts in:
- settings.go: Combined Redis config with Dynamic Client Registration config
- universal_cache_singleton.go: Merged Redis backend support with consolidated cleanup

Both features now work together:
- Redis distributed caching with circuit breaker and health checks
- Consolidated cleanup goroutine (reduces from 7 to 1)
- SkipAutoCleanup flag honored for all cache types

token_manager.go

@@ -122,15 +122,22 @@ func (t *TraefikOidc) VerifyToken(token string) error {
 			t.safeLogErrorf("Token blacklist not available, skipping JTI %s blacklist", jti)
 		}
 
-		replayCacheMu.Lock()
-		if replayCache == nil {
-			initReplayCache()
-		}
+		// Use sharded cache for replay detection - no global mutex needed
+		// This reduces lock contention by ~64x under high load
+		initReplayCache()
 		duration := time.Until(expiry)
 		if duration > 0 {
-			replayCache.Set(jti, true, duration)
+			if shardedReplayCache != nil {
+				shardedReplayCache.Set(jti, true, duration)
+			} else {
+				// Fall back to legacy cache (should rarely happen)
+				replayCacheMu.Lock()
+				if replayCache != nil {
+					replayCache.Set(jti, true, duration)
+				}
+				replayCacheMu.Unlock()
+			}
 		}
-		replayCacheMu.Unlock()
 	}
 
 	return nil