refactor(core): optimize performance, fix concurrency and clean up AGENTS.md design violations

- Concurrency: Added lock protection to WebSocket writes, fixed timer leaks, and prevented config cache listener context leaks.
- Performance: Added memory cache in ObservabilityBufferStore, periodic cleaning in CH Deduplicator, and buffered ZIP batch download writes.
- Design: Introduced Redis caching for OAuth session/tokens, sanitized raw DB error messages, segregated handlers and logics, and standard CAP response envelopes.

internal/repository/system_config_cache.go

@@ -30,8 +30,10 @@ type systemConfigInvalidationMessage struct {
 }
 
 var (
-	systemConfigRAMCache     = ram.MustNew[string, model.SystemConfig](ram.Options{MaximumSize: systemConfigRAMMaximumSize})
-	systemConfigListenerOnce sync.Once
+	systemConfigRAMCache       = ram.MustNew[string, model.SystemConfig](ram.Options{MaximumSize: systemConfigRAMMaximumSize})
+	systemConfigListenerOnce   sync.Once
+	systemConfigListenerCtx    context.Context
+	systemConfigListenerCancel context.CancelFunc
 )
 
 func ensureSystemConfigCacheListener() {
@@ -43,12 +45,19 @@ func startSystemConfigCacheInvalidationListener() {
 		return
 	}
 
+	systemConfigListenerCtx, systemConfigListenerCancel = context.WithCancel(context.Background())
+
 	go func() {
-		pubsub := db.Redis.Subscribe(context.Background(), SystemConfigInvalidationChannel)
+		pubsub := db.Redis.Subscribe(systemConfigListenerCtx, SystemConfigInvalidationChannel)
 		defer func() {
 			_ = pubsub.Close()
 		}()
 
+		go func() {
+			<-systemConfigListenerCtx.Done()
+			_ = pubsub.Close()
+		}()
+
 		for msg := range pubsub.Channel() {
 			var payload systemConfigInvalidationMessage
 			if err := json.Unmarshal([]byte(msg.Payload), &payload); err != nil {
@@ -64,6 +73,15 @@ func startSystemConfigCacheInvalidationListener() {
 	}()
 }
 
+// StopSystemConfigCacheListener stops the Redis Pub/Sub subscription listener and resets the sync.Once guard.
+func StopSystemConfigCacheListener() {
+	if systemConfigListenerCancel != nil {
+		systemConfigListenerCancel()
+		systemConfigListenerCancel = nil
+	}
+	systemConfigListenerOnce = sync.Once{}
+}
+
 func cloneSystemConfig(sc model.SystemConfig) model.SystemConfig {
 	return sc
 }