fix(credential): Enforce Null Key check at service startup

[gtema]

FernetKeyRepository::load() already detected the well-known Null Key,
but only lazily on first credential access. Add
check_startup_null_key(), wired into the keystone binary's main() right
after config load, so a misconfigured credential key repository refuses
to start immediately instead of failing on the first request.

[github-actions]

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action	Started	Stopped	Elapsed	Users
Increasing	26-07-03 18:47:35	26-07-03 18:47:52	00:00:17	0 → 30
Maintaining	26-07-03 18:47:52	26-07-03 18:48:22	00:00:30	30
Decreasing	26-07-03 18:48:22	26-07-03 18:48:22	00:00:00	0 ← 30

Request Metrics

Method	Name	# Requests	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
DELETE	DELETE /v3/auth/tokens	508	0	107.46	20	143	16.93	0.00
DELETE	DELETE /v3/projects/:id (teardown)	2	0	49.00	45	53	0.07	0.00
DELETE	DELETE /v3/users/:id (teardown)	3	0	45.67	37	55	0.10	0.00
GET		4633	0	101.44	71	191	154.43	0.00
GET	GET /v3/auth/tokens (validate new)	505	0	107.86	59	139	16.83	0.00
GET	GET /v3/projects/:id	724	0	82.78	74	115	24.13	0.00
GET	GET /v3/projects/:id (catalog)	718	0	82.97	70	113	23.93	0.00
GET	GET /v3/users/:id	1008	0	89.23	77	116	33.60	0.00
GET	GET /v3/users/:id (catalog)	795	0	88.65	75	113	26.50	0.00
POST	POST /v3/auth/tokens	504	0	81.73	72	105	16.80	0.00
	Aggregated	9400	0	95.79	20	191	313.33	0.00

Response Time Metrics

Method	Name	50%ile (ms)	60%ile (ms)	70%ile (ms)	80%ile (ms)	90%ile (ms)	95%ile (ms)	99%ile (ms)	100%ile (ms)
DELETE	DELETE /v3/auth/tokens	110	110	110	110	110	120	120	140
DELETE	DELETE /v3/projects/:id (teardown)	45	45	45	53	53	53	53	53
DELETE	DELETE /v3/users/:id (teardown)	45	45	45	45	55	55	55	55
GET		94	98	100	110	160	160	170	190
GET	GET /v3/auth/tokens (validate new)	110	110	110	110	110	120	130	139
GET	GET /v3/projects/:id	82	83	84	86	87	90	95	115
GET	GET /v3/projects/:id (catalog)	82	84	85	86	88	89	100	110
GET	GET /v3/users/:id	89	90	91	92	94	96	110	116
GET	GET /v3/users/:id (catalog)	88	89	90	91	93	95	100	110
POST	POST /v3/auth/tokens	81	82	83	84	86	88	96	105
	Aggregated	88	92	99	100	110	160	160	190

Status Code Metrics

Method	Name	Status Codes
DELETE	DELETE /v3/auth/tokens	508 [204]
DELETE	DELETE /v3/projects/:id (teardown)	2 [204]
DELETE	DELETE /v3/users/:id (teardown)	3 [204]
GET		4,633 [200]
GET	GET /v3/auth/tokens (validate new)	505 [200]
GET	GET /v3/projects/:id	724 [200]
GET	GET /v3/projects/:id (catalog)	718 [200]
GET	GET /v3/users/:id	1,008 [200]
GET	GET /v3/users/:id (catalog)	795 [200]
POST	POST /v3/auth/tokens	504 [200]
	Aggregated	513 [204], 8,887 [200]

Transaction Metrics

Transaction	# Times Run	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
ReadHeavy
0.0	1	0	20.00	20	20	0.03	0.00
0.1	788	0	100.42	85	134	26.27	0.00
0.2	785	0	83.69	74	114	26.17	0.00
0.3	784	0	82.93	73	113	26.13	0.00
TokenLifecycle
1.0	0	0	0.00	0	0	0.00	0.00
1.1	508	0	298.09	158	337	16.93	0.00
ValidateToken
2.0	0	0	0.00	0	0	0.00	0.00
2.1	764	0	157.62	119	191	25.47	0.00
UserCRUD
3.0	0	0	0.00	0	0	0.00	0.00
3.1	0	0	0.00	0	0	0.00	0.00
3.2	1008	0	89.28	77	116	33.60	0.00
3.3	3	0	45.67	37	55	0.10	0.00
ProjectCRUD
4.0	0	0	0.00	0	0	0.00	0.00
4.1	0	0	0.00	0	0	0.00	0.00
4.2	724	0	82.83	74	115	24.13	0.00
4.3	2	0	49.00	45	53	0.07	0.00
UserRead
5.0	0	0	0.00	0	0	0.00	0.00
5.1	794	0	100.23	83	132	26.47	0.00
5.2	795	0	88.69	75	113	26.50	0.00
ProjectRead
6.0	0	0	0.00	0	0	0.00	0.00
6.1	718	0	84.01	71	115	23.93	0.00
6.2	718	0	83.02	70	113	23.93	0.00
Aggregated	8392	0	107.29	20	337	279.73	0.00

Scenario Metrics

Transaction	# Users	# Times Run	Average (ms)	Min (ms)	Max (ms)	Scenarios/s	Iterations
ReadHeavy	7	782	268.12	251	304	26.07	111.71
TokenLifecycle	5	503	298.86	282	337	16.77	100.60
ValidateToken	4	760	157.72	144	191	25.33	190.00
UserCRUD	3	1005	89.31	80	116	33.50	335.00
ProjectCRUD	2	722	82.85	74	115	24.07	361.00
UserRead	5	792	189.48	174	225	26.40	158.40
ProjectRead	4	716	167.58	148	200	23.87	179.00
Aggregated	30	5280	170.36	74	337	176.00	1435.71

View full report

[github-actions]

Bencher Report

Branch	claude/adr-0019-keystone-compat-nfzp1z
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result nanoseconds (ns) (Result Δ%)	Upper Boundary nanoseconds (ns) (Limit %)
Command_Serde/apply/remove	📈 view plot 🚷 view threshold	132,770.00 ns (-55.98%) Baseline: 301,582.44 ns	1,713,833.07 ns (7.75%)
Command_Serde/apply/set	📈 view plot 🚷 view threshold	141,760.00 ns (-44.18%) Baseline: 253,956.11 ns	1,029,650.44 ns (13.77%)
Command_Serde/pack/delete	📈 view plot 🚷 view threshold	123.37 ns (+1.43%) Baseline: 121.63 ns	146.36 ns (84.29%)
Command_Serde/pack/delete_index	📈 view plot 🚷 view threshold	112.60 ns (+2.35%) Baseline: 110.01 ns	131.59 ns (85.57%)
Command_Serde/pack/set	📈 view plot 🚷 view threshold	199.04 ns (+1.82%) Baseline: 195.48 ns	239.31 ns (83.17%)
Command_Serde/pack/set_index	📈 view plot 🚷 view threshold	112.36 ns (+2.21%) Baseline: 109.93 ns	131.22 ns (85.63%)
Command_Serde/unpack/delete	📈 view plot 🚷 view threshold	198.93 ns (+3.34%) Baseline: 192.51 ns	234.66 ns (84.77%)
Command_Serde/unpack/delete_index	📈 view plot 🚷 view threshold	157.64 ns (-1.29%) Baseline: 159.70 ns	197.85 ns (79.68%)
Command_Serde/unpack/set	📈 view plot 🚷 view threshold	287.24 ns (+7.07%) Baseline: 268.26 ns	333.76 ns (86.06%)
Command_Serde/unpack/set_index	📈 view plot 🚷 view threshold	163.50 ns (+2.65%) Baseline: 159.28 ns	196.43 ns (83.24%)
Payload_encryption/pack/remove_cmd	📈 view plot 🚷 view threshold	134.02 ns (+15.66%) Baseline: 115.87 ns	140.72 ns (95.24%)
Payload_encryption/pack/set_cmd	📈 view plot 🚷 view threshold	208.84 ns (+2.87%) Baseline: 203.02 ns	267.74 ns (78.00%)
Payload_encryption/unpack/remove_cmd	📈 view plot 🚷 view threshold	201.28 ns (-1.76%) Baseline: 204.88 ns	253.54 ns (79.39%)
Payload_encryption/unpack/set_cmd	📈 view plot 🚷 view threshold	292.25 ns (+3.96%) Baseline: 281.12 ns	352.52 ns (82.90%)
Raft_1Node_Latency/prefix/1node	📈 view plot 🚷 view threshold	2,593,900.00 ns (-4.71%) Baseline: 2,721,999.84 ns	6,217,938.85 ns (41.72%)
Raft_1Node_Latency/read/1node	📈 view plot 🚷 view threshold	45,333.00 ns (+129.05%) Baseline: 19,791.85 ns	68,413.05 ns (66.26%)
Raft_1Node_Latency/remove/1node	📈 view plot 🚷 view threshold	373,950.00 ns (-35.04%) Baseline: 575,673.59 ns	2,321,986.17 ns (16.10%)
Raft_1Node_Latency/write/1node	📈 view plot 🚷 view threshold	395,570.00 ns (-33.73%) Baseline: 596,915.78 ns	2,150,774.08 ns (18.39%)
build_snapshot/default	📈 view plot 🚷 view threshold	113,520.00 ns (+2.45%) Baseline: 110,804.56 ns	162,475.18 ns (69.87%)
fernet token/project	📈 view plot 🚷 view threshold	1,446.80 ns (+4.75%) Baseline: 1,381.14 ns	1,637.20 ns (88.37%)
get_data_keyspace	📈 view plot 🚷 view threshold	0.31 ns (-0.26%) Baseline: 0.31 ns	0.36 ns (85.78%)
get_db	📈 view plot 🚷 view threshold	0.31 ns (-0.28%) Baseline: 0.31 ns	0.36 ns (85.86%)
get_fernet_token_timestamp/project	📈 view plot 🚷 view threshold	141.76 ns (-1.27%) Baseline: 143.58 ns	181.18 ns (78.24%)
get_keyspace	📈 view plot 🚷 view threshold	4.38 ns (-9.25%) Baseline: 4.83 ns	9.76 ns (44.91%)

🐰 View full continuous benchmarking report in Bencher