fix: apply code quality findings

[kojiwakayama]

Summary

Squashes safe fixes from Copilot Autofix PRs #730, #731, #733 into a single commit.

• Proxy JWKS cache: Fix race condition with idempotent cache initialization
• Proxy redirect validation: Ensure auth return path cannot be an absolute URL (open redirect prevention)
• Project discovery: Guard cache deletion against concurrent overwrites
• Version util: Use shorthand property for projectUpdated

Excluded PRs

• Potential fix for 1 code quality finding #729 (tool-helpers import): Removing .ts extension breaks Deno type checking
• Potential fix for 1 code quality finding #732 (md/utils): Adding file extension check breaks existing behavior where isMarkdownPreview intentionally returns true for undefined filePath

Closes #730, closes #731, closes #733

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: def06e2b8d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve valid query strings in auth return path

The new returnPath.includes("://") guard turns many legitimate protected URLs into from=/ (for example, /dashboard?next=https://docs.example.com) because it scans the entire path+query string, not just whether the return target itself is absolute. In those cases users lose their original destination after sign-in and are always sent to /, which is a functional regression for flows that include full URLs in query params.

Useful? React with 👍 / 👎.