perf: sync protocol and core hardening updates

deploy/migrations/0071_temp_auth_key_expiry_seek.up.sql

@@ -0,0 +1,5 @@
+-- DeleteExpiredTempAuthKeys orders/filters the binding table by expiry and then deletes the parent
+-- auth_keys rows in a bounded batch.  The PK starts with temp_auth_key_id, so it cannot serve this
+-- maintenance seek.
+CREATE INDEX IF NOT EXISTS temp_auth_key_bindings_expiry_idx
+    ON public.temp_auth_key_bindings (expires_at, temp_auth_key_id);