Harden production gaps + improve build usability (from 2026 review)

- C4: Propagate request context through semaphores and upstream calls
- C5: Make client rate limiter cleanup goroutine idempotent via sync.Once
- P1: Streaming response path using io.Copy instead of full materialization
- P2: Gate promotion goroutines to files >= 64KiB
- P3: Reduce global lock contention during eviction
- P4: Demote hot-path logging and compact metrics output
- R1: Add upstream URL scheme/host validation
- R4: Add cache file format version + tolerant deserialization
- Makefile: Make build-snapshot-single practical by using -short tests
- Config: Add GetDefaultConfig + Validate for better testability and R1 coverage

All changes follow the "smallest safe diff" principle from the review.
Safe test suite now builds and runs cleanly via make build-snapshot-single.

Ref: docs/reviews/steamcache2-production-hardening-review-2026-05-26.md

config/config.go

@@ -126,3 +126,48 @@ func SaveDefaultConfig(configPath string) error {
 
 	return nil
 }
+
+// GetDefaultConfig returns a populated default configuration (for tests and convenience).
+func GetDefaultConfig() Config {
+	return Config{
+		ListenAddress:         ":80",
+		MaxConcurrentRequests: 50,
+		MaxRequestsPerClient:  3,
+		Cache: CacheConfig{
+			Memory: MemoryConfig{
+				Size:        "1GB",
+				GCAlgorithm: "lru",
+			},
+			Disk: DiskConfig{
+				Size:        "1TB",
+				Path:        "./disk",
+				GCAlgorithm: "lru",
+			},
+		},
+		Upstream: "",
+	}
+}
+
+// Validate performs basic sanity checks on the configuration.
+func (c Config) Validate() error {
+	if c.MaxConcurrentRequests < 0 {
+		return fmt.Errorf("negative concurrency not allowed")
+	}
+	if c.MaxRequestsPerClient < 0 {
+		return fmt.Errorf("negative per-client limit not allowed")
+	}
+
+	if c.Cache.Memory.GCAlgorithm != "" {
+		switch c.Cache.Memory.GCAlgorithm {
+		case "lru", "lfu", "fifo", "largest", "smallest", "hybrid":
+		default:
+			return fmt.Errorf("invalid memory gc algorithm: %s", c.Cache.Memory.GCAlgorithm)
+		}
+	}
+
+	if c.Cache.Disk.Size != "" && c.Cache.Disk.Size != "0" && c.Cache.Disk.Path == "" {
+		return fmt.Errorf("disk cache enabled but no path specified")
+	}
+
+	return nil
+}