Diagnostics: Add INFO-level logging to SSO session init paths

[teemow]

Summary

Adds diagnostic logging and fixes for log noise from stale Valkey sessions after pod restarts.

Diagnostic Logging (original)

• Adds INFO-level diagnostic logging to the three SSO session init paths (initSSOForSession, SessionCreationHandler, onAuthenticated) to help debug why certain clients (e.g. Claude) fail to trigger downstream SSO connections after OAuth login completes.
• initSSOForSession: logs all inputs on entry and a filter breakdown (total servers, pending count, skip reasons).
• SessionCreationHandler: logs when fired with userID, familyID, and ID token presence.
• onAuthenticated: logs callback invocation with sessionID, userID, authAlive state, and ID token presence.

Fix A: Gate SSO init on valid ID token (closes #520)

• In onAuthenticated, after authStore.Touch() returns false, checks whether the ID token is empty before calling initSSOForSession().
• After a pod restart, Valkey may still have valid access tokens but no ID token in the OAuth store. Without this gate, downstream connections are established that immediately start spamming 403 errors.
• Prevents both the local server 403 spam and the remote server 403 spam that never self-heals.

Fix B: Rate-limit headerFunc warning (closes #520)

• Extracts the inline headerFunc closure from EstablishConnectionWithTokenForwarding into makeTokenForwardingHeaderFunc for testability.
• Rate-limits the WARN log when the token lookup fails to at most once per minute per session+server pair. Subsequent failures within the window are logged at DEBUG.
• When the token recovers after a failure period, logs an INFO message.

Refactor: Code review cleanups

• Consistent defer in registry: Use defer r.nameMu.Unlock() uniformly in ExposedToolName/ExposedPromptName (was inconsistent with ExposedResourceURI).
• Propagate AsBool errors: Valkey Touch/Exists/IsAuthenticated now return the error from AsBool() instead of silently returning (false, nil).
• DRY up StoreToken logic: Extracted storeIDTokenForSSO helper to eliminate duplicate token-storing code between SetSessionCreationHandler and SetTokenRefreshHandler.
• Single-responsibility createStores: Moved encryptor creation into createStores/storeBundle, removing the double type-assertion from NewAggregatorServer.
• Remove dead code: Removed unused purgeServerNames method (defined but never called).
• Idiomatic test assertions: Replaced assert.True(t, strings.Contains(...)) with assert.Contains/assert.NotContains for better failure messages.

Test plan

• All unit tests pass (make test)
• All 166 BDD scenarios pass (muster test --parallel 50)
• TestOnAuthenticated_SkipsSSO_WhenNoIDToken verifies Fix A guard logic
• TestHeaderFunc_RateLimitsWarning verifies Fix B rate-limiting and recovery logging
• Deploy and verify new logs appear in muster pod output during login flows
• Confirm filter breakdown log reveals which servers are skipped and why