Please address the comments from this code review:

## Overall Comments
- The change to `Coalescer.Coalesce` removes all single-flight/coalescing behavior and context cancellation handling, effectively turning it into a plain `fn()` call; if this is intentional, consider renaming/removing the type or documenting the new semantics, otherwise restore the previous logic.
- With `auditableServiceEndpoints` you now silently drop all service-to-service calls except the whitelisted ones; consider whether you need some observability (e.g., debug logging or metrics) for unexpected service RPCs that are no longer audited to avoid masking misconfigurations.
- The significant increase of `tokenCacheTTL`/`tokenTTL` (3→55/4→60 minutes) changes the revocation window for these tokens; it may be worth revisiting any assumptions in Central or callers that relied on shorter-lived tokens (e.g., compromise detection or key rotation timing) to ensure behavior remains acceptable.

## Individual Comments

### Comment 1
<location path="pkg/coalescer/coalescer.go" line_range="28-29" />
<code_context>
-		}
-		return result.Val.(T), nil
-	}
+	return fn()
+	// ch := c.group.DoChan(key, func() (interface{}, error) {
+	// 	return fn()
+	// })
</code_context>
<issue_to_address>
**issue (bug_risk):** Coalesce now bypasses single-flight behavior and context handling, which is likely a functional regression.

The current code returns `fn()` directly and fully bypasses the `singleflight` flow:
- Calls sharing a `key` are no longer coalesced; every caller now runs `fn()` in parallel.
- The documented `ctx` behavior (waiting callers seeing `ctx.Err()` on cancellation while the shared call continues) is no longer preserved.
If this behavior change is intentional, please either gate it (e.g., via a flag) or update the function’s contract accordingly. Otherwise, we should restore the original `singleflight` + `select` logic so existing coalescing and cancellation semantics remain intact.
</issue_to_address>