fix(cag): resolve data races, add queue observability, fix test coverage

Cycle 2 fixes from reviewer-sre + reviewer-quality:

- scheduler.go: remove delete() under RLock (data race); expired entries
  skipped on read, cleaned lazily by next MarkFailed write
- proxy.go: pre-populate transports for scheduler backends at startup to
  prevent concurrent map writes from ServeHTTP goroutines
- proxy.go: log + IncrQueueFull() on queue-full 503 path (was silent)
- proxy.go: remove stub total_tokens/hit_rate from cache-hit log event
- serviceadapter/router.go: Warnf when Auth.Required but jwtValidator nil
- observability: add queue_full_requests_total counter + Prometheus export
- scheduler_test.go: TestBackendAcquireCancelledContext (ctx cancel branch)
- proxy_test.go: implement TestWarmupHeaderHandling (remove t.Skip)
- router_test.go: TestAuthenticate_MethodCapabilityOverrideDirect (auth coverage)

internal/proxy/scheduler.go

@@ -128,10 +128,12 @@ func (s *Scheduler) selectRendezvous(cacheKey string) *Backend {
 		return scores[i].score > scores[j].score
 	})
 	for _, sc := range scores {
-		if t, failed := s.failedUntil[sc.b.Address]; !failed || now.After(t) {
-			if now.After(t) {
-				delete(s.failedUntil, sc.b.Address)
-			}
+		_, failed := s.failedUntil[sc.b.Address]
+		if !failed {
+			return sc.b
+		}
+		expiry := s.failedUntil[sc.b.Address]
+		if now.After(expiry) {
 			return sc.b
 		}
 	}