refactor(core): optimize performance, fix concurrency and clean up AGENTS.md design violations

- Concurrency: Added lock protection to WebSocket writes, fixed timer leaks, and prevented config cache listener context leaks.
- Performance: Added memory cache in ObservabilityBufferStore, periodic cleaning in CH Deduplicator, and buffered ZIP batch download writes.
- Design: Introduced Redis caching for OAuth session/tokens, sanitized raw DB error messages, segregated handlers and logics, and standard CAP response envelopes.

docs/swagger.yaml

@@ -240,23 +240,6 @@ definitions:
     - max_size_mb
     - ttl_minutes
     type: object
-  cap.ChallengeResponse:
-    properties:
-      challenge:
-        properties:
-          c:
-            type: integer
-          d:
-            type: integer
-          s:
-            type: integer
-        type: object
-      expires:
-        description: ms timestamp
-        type: integer
-      token:
-        type: string
-    type: object
   cap.challengeRequest:
     properties:
       scope:
@@ -585,6 +568,23 @@ definitions:
       version:
         type: string
     type: object
+  github_com_Rain-kl_Wavelet_internal_apps_cap.ChallengeResponse:
+    properties:
+      challenge:
+        properties:
+          c:
+            type: integer
+          d:
+            type: integer
+          s:
+            type: integer
+        type: object
+      expires:
+        description: ms timestamp
+        type: integer
+      token:
+        type: string
+    type: object
   github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse:
     properties:
       error:
@@ -3945,11 +3945,16 @@ paths:
         "200":
           description: 成功返回 PoW 难题
           schema:
-            $ref: '#/definitions/cap.ChallengeResponse'
+            allOf:
+            - $ref: '#/definitions/response.Any'
+            - properties:
+                data:
+                  $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.ChallengeResponse'
+              type: object
         "500":
           description: 内部服务错误
           schema:
-            $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse'
+            $ref: '#/definitions/response.Any'
       summary: 生成人机验证难题
       tags:
       - cap
@@ -3971,15 +3976,20 @@ paths:
         "200":
           description: 核销成功，返回 X-Cap-Token
           schema:
-            $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse'
+            allOf:
+            - $ref: '#/definitions/response.Any'
+            - properties:
+                data:
+                  $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse'
+              type: object
         "400":
           description: 参数错误或核销失败
           schema:
-            $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse'
+            $ref: '#/definitions/response.Any'
         "500":
           description: 内部服务错误
           schema:
-            $ref: '#/definitions/github_com_Rain-kl_Wavelet_internal_apps_cap.RedeemResponse'
+            $ref: '#/definitions/response.Any'
       summary: 校验人机验证解答
       tags:
       - cap