v0.7.0

v0.7.0 — Tessera cloud control plane

- OAuth 2.1 resource-server validator (tessera/auth/oauth_rs.py:
  OAuthResourceServer, validate_bearer_token, require_scope decorator,
  5-min TTL token cache, Ed25519 local verify + JWKS fallback)
- Cloud policy sync (tessera/cloud_sync.py: CloudPolicySync with SQLite
  cache at ~/.tessera/policy-cache.db + background refresh loop)
- Audit cloud uploader (tessera/audit/cloud_uploader.py:
  AuditCloudUploader with batched POST, exponential backoff,
  queue-front restore on failure, public flush_once())
- DecisionCache LRU+TTL on hot path (tessera/proxy.py: 60s TTL,
  1024 entries, skip blocks, cleared on policy reload)
- tessera login + tessera config sync + tessera audit emit/upload
  (tessera/cli.py)
- CRITICAL fixes from code-audit-2026-05-22: pack-status filter
  accepts production+active, scale-tier license decode, _TIER_ORDER
  includes scale.

Server side (cloudmorph-mono-repo v0.7.0):
- OAuth 2.1 authorization server Lambda + 5 endpoints
- HTTP API Lambda authorizer + parallel /api/cli/* route surface
- POST /api/tessera/audit/ingest endpoint
- Currently reachable at https://hiya106w1a.execute-api.us-east-1.amazonaws.com/
  (v0.7.1 will add auth.tessera.cloudmorph.ai CustomDomain)

Bundled oauth_pubkey.pem matches the Ed25519 keypair in AWS Secrets
Manager tessera/oauth/jwt-signing-key-prod (generated 2026-05-24).