test(coverage): drive internal/middleware to 95.3% (≥95% target) (#155)

middleware was ~51.8%; black-box + white-box suites now cover auth
bearer/JWT extraction, fingerprint masking + dedup cap, geo fail-open
(+ real MaxMind fixture), rate-limit fail-open on Redis error,
idempotency canonicalisation, DPoP helpers, role lookup, and the
NewRelic emit path. Also fixes a flaky base64-prefix assertion in the
already-merged crypto coverage test (a random nonce can legitimately
begin with "v"; the real invariant is "not a vN. versioned envelope").

internal/middleware 95.3% · internal/crypto 95.6%

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/crypto/coverage_test.go

@@ -243,7 +243,9 @@ func TestKeyring_Decrypt_LegacyUnversioned(t *testing.T) {
 	keyA := mustKey(t, coverageKeyHexA)
 	legacy, err := crypto.Encrypt(keyA, "pre-rotation-secret")
 	require.NoError(t, err)
-	require.False(t, strings.HasPrefix(legacy, "v"))
+	// A raw Encrypt envelope is base64 (random nonce), so it may coincidentally
+	// begin with "v"; the invariant is that it is NOT a "vN." versioned envelope.
+	require.False(t, len(legacy) >= 3 && legacy[0] == 'v' && legacy[2] == '.' && legacy[1] >= '1' && legacy[1] <= '9')
 
 	kr, err := crypto.NewKeyring('1', map[byte][]byte{'1': keyA})
 	require.NoError(t, err)