v7.0.0

Changed

• OpenTelemetry SoT upgraded to the coherent 1.45 / 0.66 pair, with major-floor
  ranges (not exact pins): opentelemetry-api / opentelemetry-sdk / OTLP
  exporters / opentelemetry-propagator-b3 are ^1.45.0 (>=1.45.0,<2);
  opentelemetry-semantic-conventions and all opentelemetry-instrumentation*
  are >=0.66b0,<1. Replaces the previous 1.43 / 0.64 floor and the
  thrash-prone instrumentation*^0 hole. Consumers (e.g. payment_backend)
  can drop app-level OTel pins after bumping FFU.

Security

• CORS defaults are deny-by-default: allow_origins=[],
  allow_credentials=False. FastAPIBuilder only installs
  CORSMiddleware when allow_origins is non-empty. Config validation
  rejects "*" combined with allow_credentials=True (closes the
  Starlette Origin-reflection footgun). Breaking for consumers that relied
  on the previous ["*"] + credentials defaults — set explicit origins
  (and credentials if needed) in application.yaml.
• Hydra JWT introspection cache keys are namespaced by configured issuer
  (issuer + NUL + jti), not jti alone, preventing cross-issuer
  cache confusion in a shared process. Cache hits also re-check exp.
• JWT: authorized_audiences is required and always passed to PyJWT
  decode (fail closed). Legacy audience is a deprecated alias that
  populates authorized_audiences. README sample updated.
  Breaking for configs that only set issuer (or only the unused
  audience field without realizing it was ignored).