Bug Fixes

• api-keys: a malformed organisation id can no longer take auth-api down (9885c10), closes HI#1
• api-keys: never store a raw API key for idempotent replays (3c6cac8)
• rate-limit: anonymous traffic can no longer lock valid credentials out (46a2eb5), closes HI#2
• verify: let chargers reach the setup challenge without credentials (b56d282)
• deps: move lapin to 4.12 (4919be0)
• deps: move sqlx to 0.9 (92d86fa)
• verify: an API key authenticates only on its tenant_id, never its slug (a869d7f)
• api-keys: a tenant lists and revokes only its own keys (2aedbe3)
• deps: clear the October RustSec advisories (2ff778f)

Features

• scopes: report-first rules for customer platform-only scopes and service tokens (6d1ed5a)