Keystead Server 0.4.5

This release prevents concurrent sync writes from leaving gaps or mixing vault fingerprints, preserves access-request ownership on duplicate IDs, and expires approved restore packages.

• Serialize append and purge transactions using a database lock on the permanent account row; insert new fingerprint bindings atomically.
• Create access requests with insert-only persistence, preserving existing owners and approvals on collisions.
• Stop exposing approved packages after expiry and remove expired requests through scheduled cleanup. Flyway migration V31 adds an expiry index.
• Accept the long credentials historically allowed by registration, including passwords longer than 1,024 characters.

Validation: 103 tests passed on both H2 and PostgreSQL 16.15. After the final password compatibility correction, all 6 targeted authentication tests passed on both databases. Four live client/server flows also passed against PostgreSQL.

The server retains its tested keystead-core:0.4.5 dependency; these server fixes do not require the new Client-facing Core APIs.