test(coverage): db/cache/nosql local providers to >=95% via source seams

[mastermanas805]

Summary

Closes the coverage gap on the three local-backend providers to the >=95% mandate using deterministic source seams (org policy now requires seams, not waivers). Production defaults are unchanged — every seam defaults to the real fn/value.

Package	Before	After
internal/providers/db	2.2%	97.8% (local.go fully covered)
internal/providers/cache	64.8%	98.2%
internal/providers/nosql	70.3%	100.0%

Seams added (package vars / interfaces, real default)

• db/local.go — randInt (crypto/rand.Int), pgConn interface + pgxConnect factory. An in-memory fake pgConn drives the RNG failure, the conn.Close defer-error logs, and the non-fatal REVOKE / GRANT / DROP USER exec-error logs.
• cache/redis.go — randRead (crypto/rand.Read); storageBytesScanCap (test-lowerable truncation ceiling, default storageMaxKeys=200k); redisScanner interface behind a storageBytes helper. The mid-scan vanished-key skip is now deterministic (a fake returns a SCAN key that MEMORY USAGE reports missing); the truncation branch fires with a handful of keys (no 200k write, no timing).
• nosql/mongo.go — randRead (crypto/rand.Read); mongoDisconnect seam for the Disconnect defer-error logs; storageSizeToInt64 extracted so every numeric BSON arm is unit-testable.

Notable fixes over the prior attempt (supersedes #148)

• Replaced the flaky timing-based MEMORY-USAGE-skip test with a deterministic interface fake.
• Aligned the db test env var to TEST_POSTGRES_CUSTOMERS_URL (what CI's coverage.yml provides). The prior attempt used TEST_CUSTOMERS_URL and silently skipped in CI, contributing zero coverage.
• Hardened uniqueToken with a per-run random seed so same-second runs against a shared Postgres can't collide with orphan databases.

Test plan

• go test ./internal/providers/{db,cache,nosql} -count=1 -p 1 green against local docker pg16 / redis7 / mongo6 on 127.0.0.1
• Per-package coverage all >=95% (97.8 / 98.2 / 100.0)
• Stable across 3 consecutive full runs (no flake)
• CI-safe: clean skip with no env vars; go build ./... + go vet ./... clean; gofmt -l clean
• CI gate (coverage / ci / deploy) green on this PR

🤖 Generated with Claude Code