fix(loader): wire context into HTTP request, guard nil opts in Redis list/hash

- HTTPLoader.Load: http.NewRequest → NewRequestWithContext so caller
  cancellation/deadlines propagate to the outgoing request
- RedisListLoader, RedisHashLoader: add nil-guard before calling opt()
  (already present in StringLoader, SetLoader, and HTTPLoader)
- Add doc comments for all 10 exported symbols (package, interfaces,
  constructors, option types, option funcs, DefaultRedisKey)
- Add loader_test.go with 32 tests covering FileLoader, HTTPLoader
  (context cancel, error status, empty/large body), Redis options,
  nil-guard safety, and interface satisfaction checks

internal/loader/loader.go

@@ -1,3 +1,5 @@
+// Package loader provides interfaces and implementations for hot-reloadable
+// data sources used by components such as auth, bypass, hosts, and admission.
 package loader
 
 import (
@@ -5,15 +7,18 @@ import (
 	"io"
 )
 
+// Loader loads data from a backend source, returning it as an io.Reader.
 type Loader interface {
 	Load(context.Context) (io.Reader, error)
 	Close() error
 }
 
+// Lister lists entries from a backend source.
 type Lister interface {
 	List(ctx context.Context) ([]string, error)
 }
 
+// Mapper loads key-value pairs from a backend source.
 type Mapper interface {
 	Map(ctx context.Context) (map[string]string, error)
 }