fix(lint): repair the two findings the full gate surfaced

Both are fallout from earlier commits in this branch.

4b10d6b93 moved redirect_uris.py from the keycloak role's filter_plugins to
plugins/lookup, but the requirements doc still linked the old path, which
test_relative_links flagged.

test_primitives.py reads back a file that download_file just wrote into the
test's own TemporaryDirectory. test_no_uncached_file_reads asks for
utils.cache.files.read_text, but its own message names this case as the
opt-out -- "tempdirs, synthetic fixtures written inside the same test" -- and
read_text is wrong here anyway: the payload is bytes, and a session-shared
cache would defeat the point of asserting what was just written. Same marker
as tests/integration/meta/workflows/test_subset_roles.py:40.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/requirements/031-svc-net-tor-onion.md

@@ -24,7 +24,7 @@ The `.onion` is a **deploy-time input**: a CLI helper mints the v3 key offline d
 | TLS-disabled vhosts serve plain HTTP on `:80`; the http→https 301 exists only in the TLS layer | [`roles/sys-front-tls/templates/http.conf.j2`](../../roles/sys-front-tls/templates/http.conf.j2) |
 | TLS is resolved per `(domain\|application_id)` with `TLS_MODE`/`TLS_ENABLED` defaults, flavors in `AVAILABLE_FLAVORS` | [`plugins/lookup/tls.py`](../../plugins/lookup/tls.py), `utils/tls_common` |
 | `DOMAIN_PRIMARY` defined once; `LDAP_DN_BASE`, CA identity, contact email derive from it | [`group_vars/all/00_general.yml:50`](../../group_vars/all/00_general.yml), [`group_vars/all/12_ldap.yml`](../../group_vars/all/12_ldap.yml), [`group_vars/all/02_tls.yml`](../../group_vars/all/02_tls.yml), [`group_vars/all/14_about.yml`](../../group_vars/all/14_about.yml) |
-| Keycloak redirect URIs/web-origins are computed from `lookup('domains')` at deploy | [`roles/web-app-keycloak/filter_plugins/redirect_uris.py`](../../roles/web-app-keycloak/filter_plugins/redirect_uris.py), [`roles/web-app-keycloak/vars/main.yml`](../../roles/web-app-keycloak/vars/main.yml) |
+| Keycloak redirect URIs/web-origins are computed from `lookup('domains')` at deploy | [`plugins/lookup/redirect_uris.py`](../../plugins/lookup/redirect_uris.py), [`roles/web-app-keycloak/vars/main.yml`](../../roles/web-app-keycloak/vars/main.yml) |
 | Apps register one vhost per domain via `include_role: sys-stk-front-proxy` with `domain` + `http_port`; multi-domain is established practice | [`roles/sys-stk-front-proxy/tasks/main.yml`](../../roles/sys-stk-front-proxy/tasks/main.yml), [`roles/web-app-matrix/tasks/flavor/compose/03_webserver.yml`](../../roles/web-app-matrix/) |
 | Extra app domains live in `applications.<app>.server.domains.{canonical,aliases}` (str/list/dict) | [`utils/domains/application_domain_index.py`](../../utils/domains/application_domain_index.py), [`plugins/filter/canonical_domains_map.py`](../../plugins/filter/canonical_domains_map.py) |
 | Inventory build/secrets tooling (mint-helper integration point) | [`cli/administration/inventory/credentials/`](../../cli/administration/inventory/) |

tests/unit/utils/install/test_primitives.py

@@ -93,7 +93,7 @@ class TestDownloadFile(unittest.TestCase):
         ):
             primitives.download_file("https://example.test/a", self.target)
         self.assertEqual(opener.call_count, 2)
-        self.assertEqual(Path(self.target).read_bytes(), b"payload")
+        self.assertEqual(Path(self.target).read_bytes(), b"payload")  # nocheck: cache-read
 
     def test_client_error_is_fatal_on_the_first_attempt(self) -> None:
         opener = mock.Mock(