Decouple user provisioning from HTTPS identity storage while retaining
compatible v1 user records and migrating TLS material to the
credential-free
v2 format. Add focused security regression coverage and update operator
documentation.
Add a short-lived, HMAC-keyed cache for validated principals and
invalidate entries when principals become stale. Improve duplicate SSH
key
errors and enable Ed25519 streaming verification.