feat: Resolve sharded URL at startup

[clement0010]

Issue: #292

Changes

• Resolve sharded Twingate host at config load time by sending a HEAD request to the JWKS endpoint and extract the Location header
  • resolveTwingateHostname extract the Location header and don't follow the redirect
  • stripNetworkPrefix strips the network prefix from the resolved hostname (e.g., acme.us1.twingate.com → us1.twingate.com)
  • Falls back to the original host on any connection error
• Support sharded hosts in JWT issuer validation via suffix matching in getIssuer()

Note: Sharded host is not supported in production yet. This is preparation work, so the operator is ready when sharding is enabled in production.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.40%. Comparing base (789c610) to head (1025fa0).
⚠️ Report is 3 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #293      +/-   ##
==========================================
+ Coverage   85.24%   85.40%   +0.15%     
==========================================
  Files          36       36              
  Lines        2657     2686      +29     
==========================================
+ Hits         2265     2294      +29     
  Misses        264      264              
  Partials      128      128              

Flag	Coverage Δ
integration	53.91% <17.24%> (-0.43%)	⬇️
unit	77.73% <100.00%> (+0.24%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/start.go	54.54% <100.00%> (+1.42%)	⬆️
internal/config/config.go	88.53% <100.00%> (+1.14%)	⬆️
internal/token/parser.go	93.33% <100.00%> (+1.33%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR prepares the gateway for sharded Twingate hosts by resolving the effective host during configuration loading and allowing JWT issuer validation for sharded hostnames.

Changes:

• Adds config-time hostname resolution via HEAD request to the JWKS endpoint.
• Adds host suffix matching for JWT issuer selection.
• Adds tests for hostname stripping/resolution and sharded issuer handling.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/config/config.go	Adds sharded hostname resolution during config load.
internal/config/config_test.go	Adds tests for hostname stripping and redirect resolution.
internal/token/parser.go	Adds issuer lookup helper with suffix matching for sharded hosts.
internal/token/parser_test.go	Adds tests for sharded issuer lookup and parser behavior.
go.mod	Promotes go-retryablehttp to a direct dependency.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[clement0010]

With this configuration we get:

Step	What	Duration
Attempt 0	HEAD → timeout	1s
Backoff 0	2^0 × 1s	1s
Attempt 1	HEAD → timeout	1s
Backoff 1	2^1 × 1s	2s
Attempt 2	HEAD → timeout	1s
Backoff 2	2^2 × 1s	4s
Attempt 3	HEAD → timeout	1s

Total = 11s

I think 11s is fine? Alternatively, we can shorten the backoff to 0.5s or set the max attempt to 2, to squeeze within the 10s window

[minhtule]

• Yes, I would lower the max retries to 2. Maybe also increase the timeout to 2s.
• Why is the number of retries passed in as an argument but the 1s timeout is hard coded here?

[clement0010]

Why is the number of retries passed in as an argument but the 1s timeout is hard coded here?

We are setting the same value (1 second) for the test as well, so Go lint complains: internal/config/config.go:196:61: resolveTwingateHostname - timeout always receives 1 * time.Second (1000000000) (unparam), whereas retryMax is set to 0 for all tests

[minhtule]

Fix & merge!

[minhtule]

• Yes, I would lower the max retries to 2. Maybe also increase the timeout to 2s.
• Why is the number of retries passed in as an argument but the 1s timeout is hard coded here?