test: raise core-package unit coverage to 90% (#98)

Raises statement coverage of the core packages (all of `internal/` except the interactive `tui/`, plus `pkg/`) from **8.7% to 90.1%**.

## Approach
- **Pure-go unit tests** for all providers, virtual mergers, classifier, config, auth, models, and the API client (httptest).
- **Testcontainers-backed** tests (new `internal/testsupport` helper: Postgres/Redis/MinIO, Ryuk disabled) for database, storage, cache, the proxy engine, the GC, and a full-stack `server` test that drives the whole HTTP API. These `t.Skip` when Docker is absent so `go test` still runs locally without it.

## Measuring
```
go test -coverpkg=./internal/...,./pkg/... -coverprofile=cover.out ./internal/... ./pkg/...
grep -v /internal/tui/ cover.out | go tool cover -func=/dev/stdin | tail -1   # 90.1%
```
Run with `-p 1` (containers are heavy).

## Notes
- The interactive `tui/` package and `cmd/main` are excluded from the target per the agreed scope.
- Some defensive error branches are covered via fault injection (closed DB pool, killing MinIO mid-upload).

Reviewed-on: #98
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

internal/api/v1/scheme_test.go

@@ -0,0 +1,20 @@
+package v1
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+)
+
+func TestScheme(t *testing.T) {
+	if got := scheme(&http.Request{TLS: &tls.ConnectionState{}}); got != "https" {
+		t.Errorf("TLS request scheme = %q, want https", got)
+	}
+	r := &http.Request{Header: http.Header{"X-Forwarded-Proto": {"https"}}}
+	if got := scheme(r); got != "https" {
+		t.Errorf("X-Forwarded-Proto scheme = %q, want https", got)
+	}
+	if got := scheme(&http.Request{Header: http.Header{}}); got != "http" {
+		t.Errorf("default scheme = %q, want http", got)
+	}
+}