refactor(core): optimize performance, fix concurrency and clean up AGENTS.md design violations

- Concurrency: Added lock protection to WebSocket writes, fixed timer leaks, and prevented config cache listener context leaks.
- Performance: Added memory cache in ObservabilityBufferStore, periodic cleaning in CH Deduplicator, and buffered ZIP batch download writes.
- Design: Introduced Redis caching for OAuth session/tokens, sanitized raw DB error messages, segregated handlers and logics, and standard CAP response envelopes.

internal/apps/openflare/chwriter/dedup.go

@@ -11,12 +11,16 @@ import (
 const dedupTTL = 2 * time.Minute
 
 type dedupSet struct {
-	mu   sync.Mutex
-	keys map[string]time.Time
+	mu          sync.Mutex
+	keys        map[string]time.Time
+	lastCleanup time.Time
 }
 
 func newDedupSet() *dedupSet {
-	return &dedupSet{keys: make(map[string]time.Time)}
+	return &dedupSet{
+		keys:        make(map[string]time.Time),
+		lastCleanup: time.Now(),
+	}
 }
 
 // markIfNew records key when it has not been seen within dedupTTL.
@@ -29,11 +33,16 @@ func (s *dedupSet) markIfNew(key string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	for existing, expiresAt := range s.keys {
-		if now.After(expiresAt) {
-			delete(s.keys, existing)
+	// Periodically clean up all expired keys (e.g., every 30 seconds)
+	if now.Sub(s.lastCleanup) >= 30*time.Second {
+		for existing, expiresAt := range s.keys {
+			if now.After(expiresAt) {
+				delete(s.keys, existing)
+			}
 		}
+		s.lastCleanup = now
 	}
+
 	if expiresAt, exists := s.keys[key]; exists && now.Before(expiresAt) {
 		return false
 	}