chore: post-2.2.0 cleanup batch

[SyniRon]

Post-2.2.0 cleanup batch — four small, independent code edits. No release, no version bump, no consumer-visible behavior change. Ships with the next feature release.

Changes

• servers/server.go — Fatalf format-string vet fixes (%w → %v on L139; verb-less %v added on L183, L191).
• middleware/cache.go — tighten tickets cache-bypass from loose HasPrefix to exact path OR trailing-slash prefix. Defense-in-depth; no existing route changes behavior.
• servers/server.go — setupRedis no longer exits on empty REDIS_PASSWORD; logs an info line and connects without AUTH. Prod is unaffected (password is set in compose env); enables local-dev against a vanilla redis:7.
• cmd/serve.go, servers/server.go — document that PORT is the gateway-to-grpc dial target, not a listen port. Both listen ports are hardcoded. (CLAUDE.md got a matching paragraph update on disk for local-Claude context; that file is .gitignored in this repo so it does not appear in this diff.)

Commits

Five commits — four tasks plus one fix-up on the PORT doc commit to drop a misleading "loopback" word and rewrite the New doc-comment to drop the inaccurate "not a listen address" framing. Squash-merge.

Verification

• go vet ./... is clean (the three pre-existing warnings on servers/server.go L139/183/191 are gone).
• go build ./... exits 0.
• Local smoke against the xenforo-db mirror (v2.2.0 schema present): binary starts with empty REDIS_PASSWORD and logs the new REDIS_PASSWORD empty — connecting without AUTH info line (Task 3 verified end-to-end); both :10000 and :11000 bind; OpenAPI UI returns 200; /api/v1/milpac/1 and /api/v1/tickets[/123] return 401 against the gateway, proving the gateway-to-gRPC dial path works under PORT=10000 (Task 4 invariant verified).
• Cache-bypass conditional (cache.go change): no raw API token was available locally, so verified by build + vet + code-review (cache middleware sits inside auth; the conditional only fires on authenticated requests).
• No proto changes; no make generate needed.
• No new endpoints; no monitoredTables change needed.
• No test suite exists in this repo.

Closes #70