fix(cag): extract applyWarmup/acquireScheduledBackend helpers, add race-free tests

- proxy.go: extract applyWarmup + acquireScheduledBackend to reduce ServeHTTP complexity
- proxy_test.go: TestProxyQueueFull, TestProxyCacheHitLogging (AC5/AC6/AC7 HTTP-level coverage)
- scheduler_test.go: TestBackendAcquireCancelledContext + runtime.Gosched spin-wait (no time.Sleep)
- router_test.go: TestAuthenticate_MethodCapabilityOverrideDirect with real RS256 JWT + JWKS server

internal/proxy/scheduler_test.go

@@ -3,6 +3,7 @@ package proxy
 import (
 	"context"
 	"errors"
+	"runtime"
 	"sync"
 	"testing"
 	"time"
@@ -23,8 +24,10 @@ func TestBackendAcquireBlocksThenUnblocksOnRelease(t *testing.T) {
 		g2Done <- b.Acquire(context.Background())
 	}()
 
-	// Give G2 time to block.
-	time.Sleep(20 * time.Millisecond)
+	// Wait until G2 enters the queue channel (proves Acquire is blocking on slots).
+	for len(b.queue) == 0 {
+		runtime.Gosched()
+	}
 
 	select {
 	case err := <-g2Done:
@@ -119,8 +122,10 @@ func TestBackendAcquireCancelledContext(t *testing.T) {
 		g2Done <- b.Acquire(ctx)
 	}()
 
-	// Give G2 time to enter the queue and block waiting for a slot.
-	time.Sleep(20 * time.Millisecond)
+	// Wait until G2 enters the queue channel.
+	for len(b.queue) == 0 {
+		runtime.Gosched()
+	}
 
 	// Verify G2 is queued (queue channel has one item).
 	if qd := len(b.queue); qd != 1 {