perf: sync protocol and core hardening updates

deploy/migrations/0065_auth_key_orphan_retention.up.sql

@@ -0,0 +1,4 @@
+-- Bounded orphan auth-key GC seeks by creation time. Authorization and temp-key references are
+-- rechecked in the DELETE statement; active raw keys are supplied by the connection registry.
+CREATE INDEX IF NOT EXISTS auth_keys_orphan_retention_idx
+    ON public.auth_keys (created_at, auth_key_id);