fix(08-09): match wristband OAuth byte contract to live-recorded PHP

Recording the full mcp-lifecycle fixture against real isolated PHP
(08-09-PLAN.md Task 2) uncovered three byte-level gaps between wristband's
assumed contract and actual production PHP behavior:

- Every explicit "Cache-Control: no-store" PHP sets is actually delivered
  as "no-store, private" (Laravel's session-cookie default merges "private"
  onto any explicit value); wristband's own default for unheadered JSON
  error responses is "no-cache, private" (matching the house convention
  already used elsewhere), not empty.
- PHP's redirect responses (authorize success and every error redirect)
  render Symfony's default HTML redirect body with Content-Type
  "text/html; charset=utf-8"; Go's bare 302 with no body never matched.
  wristband/redirect_html.go ports that exact byte template, including
  PHP's htmlspecialchars(ENT_QUOTES) escaping (Go's html.EscapeString uses
  different quote entities).

tide/normalize.go: isIDKey now also masks "_ids" plural array fields
(e.g. collection_ids), a latent parity-corpus gap no prior fixture had
exercised with a literal, non-empty, non-placeholder array value.

wristband/registration_test.go

@@ -314,8 +314,8 @@ func TestPhase8RedRegistration(t *testing.T) {
 	if _, hasSecret := got["client_secret"]; hasSecret {
 		t.Fatal("PHASE8_RED:registration: public client response has a client_secret, want none")
 	}
-	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
-		t.Fatalf("PHASE8_RED:registration: Cache-Control = %q, want \"no-store\"", cc)
+	if cc := rec.Header().Get("Cache-Control"); cc != "no-store, private" {
+		t.Fatalf("PHASE8_RED:registration: Cache-Control = %q, want \"no-store, private\"", cc)
 	}
 }
 
@@ -614,7 +614,7 @@ func assertRegisterError(t *testing.T, rec *httptest.ResponseRecorder, status in
 	if got["error_description"] != description {
 		t.Fatalf("error_description = %v, want %q", got["error_description"], description)
 	}
-	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
-		t.Fatalf("Cache-Control = %q, want \"no-store\"", cc)
+	if cc := rec.Header().Get("Cache-Control"); cc != "no-store, private" {
+		t.Fatalf("Cache-Control = %q, want \"no-store, private\"", cc)
 	}
 }