fix(sns): collapse concurrent cert-cache misses via singleflight (bug-bash #1/#9)

[mastermanas805]

What

snsVerifier.getCert read the cert cache under RLock and, on a miss, fetched the cert over the network and wrote it under Lock — with nothing between the read-miss and the write. A burst of concurrent SNS deliveries that all miss the cache (cold start, or the instant after the 24h TTL expires) each fire their own fetchCert and then race to overwrite the map: a thundering herd against the AWS cert endpoint.

Fix

Collapse the miss path through a singleflight.Group keyed by certURL (the same primitive already used in internal/cache/redis.go, team_summary.go, billing_usage.go) so a concurrent burst issues exactly one fetch between them; followers receive the leader's result. The fast-path RLock cache hit is unchanged.

Coverage

Symptom:        N concurrent cache-miss deliveries → N redundant cert fetches (herd)
Enumeration:    grep certCache/getCert internal/handlers/sns_verify.go (single getCert)
Sites found:    1
Sites touched:  1
Coverage test:  TestSNSVerifyFinal2_GetCert_SingleflightCollapsesConcurrentMisses
Live verified:  passes under -race; go tool cover → getCert 100.0%

20 concurrent missing-cache getCert calls, fetch held open on a channel so all collapse onto one in-flight call; asserts exactly 1 fetchCert.

🤖 Generated with Claude Code