fix(tls): honor Go key exchange defaults across transports

Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0
across Server listeners, node links and outbound transports. Remove the
unused shared curve option and add wire-level regression coverage.

Document CA trust and TLS upgrade behavior, retain the investigation
artifacts, and exclude their synthetic routes from the rebrand guard.
The product compatibility baseline remains unchanged.

Validation: focused race tests, HTTP tests, lint, compatibility guard
positive/negative controls, and a fresh Linux build with three isolated
OIDC integration scenarios all pass.

Adversarial review: Claude Code Fable 5.1, max effort.
Final verdict: APPROVE FOR COMMIT.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/http/transports.go

@@ -46,9 +46,8 @@ type ConnSettings struct {
 	DialTimeout time.Duration
 
 	// TLS Settings
-	RootCAs          *x509.CertPool
-	CipherSuites     []uint16
-	CurvePreferences []tls.CurveID
+	RootCAs      *x509.CertPool
+	CipherSuites []uint16
 
 	// HTTP2
 	EnableHTTP2 bool
@@ -70,7 +69,6 @@ func (s ConnSettings) getDefaultTransport(maxIdleConnsPerHost int) *http.Transpo
 	tlsClientConfig := tls.Config{
 		RootCAs:            s.RootCAs,
 		CipherSuites:       s.CipherSuites,
-		CurvePreferences:   s.CurvePreferences,
 		ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
 	}