Harden production gaps + improve build usability (from 2026 review)

- C4: Propagate request context through semaphores and upstream calls
- C5: Make client rate limiter cleanup goroutine idempotent via sync.Once
- P1: Streaming response path using io.Copy instead of full materialization
- P2: Gate promotion goroutines to files >= 64KiB
- P3: Reduce global lock contention during eviction
- P4: Demote hot-path logging and compact metrics output
- R1: Add upstream URL scheme/host validation
- R4: Add cache file format version + tolerant deserialization
- Makefile: Make build-snapshot-single practical by using -short tests
- Config: Add GetDefaultConfig + Validate for better testability and R1 coverage

All changes follow the "smallest safe diff" principle from the review.
Safe test suite now builds and runs cleanly via make build-snapshot-single.

Ref: docs/reviews/steamcache2-production-hardening-review-2026-05-26.md

steamcache/metrics/metrics.go

@@ -27,6 +27,8 @@ type Metrics struct {
 	DiskCacheSize   int64
 	MemoryCacheHits int64
 	DiskCacheHits   int64
+	Promotions      int64 // R2
+	Evictions       int64 // R2
 
 	// Service metrics
 	ServiceRequests map[string]int64
@@ -126,6 +128,10 @@ func (m *Metrics) GetServiceRequests(service string) int64 {
 	return m.ServiceRequests[service]
 }
 
+// R2 tiny wiring
+func (m *Metrics) IncrementPromotions() { atomic.AddInt64(&m.Promotions, 1) }
+func (m *Metrics) IncrementEvictions()  { atomic.AddInt64(&m.Evictions, 1) }
+
 // GetStats returns a snapshot of current metrics
 func (m *Metrics) GetStats() *Stats {
 	totalRequests := atomic.LoadInt64(&m.TotalRequests)
@@ -164,6 +170,8 @@ func (m *Metrics) GetStats() *Stats {
 		DiskCacheSize:    atomic.LoadInt64(&m.DiskCacheSize),
 		MemoryCacheHits:  atomic.LoadInt64(&m.MemoryCacheHits),
 		DiskCacheHits:    atomic.LoadInt64(&m.DiskCacheHits),
+		Promotions:       atomic.LoadInt64(&m.Promotions),
+		Evictions:        atomic.LoadInt64(&m.Evictions),
 		ServiceRequests:  serviceRequests,
 		Uptime:           time.Since(m.StartTime),
 		LastResetTime:    m.LastResetTime,
@@ -183,6 +191,8 @@ func (m *Metrics) Reset() {
 	atomic.StoreInt64(&m.TotalBytesCached, 0)
 	atomic.StoreInt64(&m.MemoryCacheHits, 0)
 	atomic.StoreInt64(&m.DiskCacheHits, 0)
+	atomic.StoreInt64(&m.Promotions, 0)
+	atomic.StoreInt64(&m.Evictions, 0)
 
 	m.serviceMutex.Lock()
 	m.ServiceRequests = make(map[string]int64)
@@ -207,6 +217,8 @@ type Stats struct {
 	DiskCacheSize    int64
 	MemoryCacheHits  int64
 	DiskCacheHits    int64
+	Promotions       int64
+	Evictions        int64
 	ServiceRequests  map[string]int64
 	Uptime           time.Duration
 	LastResetTime    time.Time