Harden production gaps + improve build usability (from 2026 review)

- C4: Propagate request context through semaphores and upstream calls
- C5: Make client rate limiter cleanup goroutine idempotent via sync.Once
- P1: Streaming response path using io.Copy instead of full materialization
- P2: Gate promotion goroutines to files >= 64KiB
- P3: Reduce global lock contention during eviction
- P4: Demote hot-path logging and compact metrics output
- R1: Add upstream URL scheme/host validation
- R4: Add cache file format version + tolerant deserialization
- Makefile: Make build-snapshot-single practical by using -short tests
- Config: Add GetDefaultConfig + Validate for better testability and R1 coverage

All changes follow the "smallest safe diff" principle from the review.
Safe test suite now builds and runs cleanly via make build-snapshot-single.

Ref: docs/reviews/steamcache2-production-hardening-review-2026-05-26.md

Makefile

@@ -9,7 +9,8 @@ test: deps ## Run all tests
 deps: ## Download dependencies
 	@go mod tidy
 
-build-snapshot-single: deps test ## Build a snapshot of the application for the current platform
+build-snapshot-single: deps ## Build a snapshot of the application for the current platform (uses -short for fast feedback)
+	@go test -short -v ./...
 	@goreleaser build --single-target --snapshot --clean
 
 help: ## Show this help message