Release v3.1.0

TKeeper 3.1.0 focuses on reducing third-party runtime dependencies and enforcing explicit security boundaries during packaging.
This release moves to Helidon, replaces heavyweight transport and cloud KMS clients, and adds build-time checks for protected API access, required security components, and production/test isolation. It also verifies bundled native-library integrity and requires explicit opt-in for system-library fallback.

Changes

• Replaced Armeria and Micronaut with Helidon WebServer and an explicitly generated service registry.
• Migrated outbound HTTP transport to Jettyx 0.2.0 and JDK HTTP, removing Jetty and Netty from the runtime.
• Replaced AWS and Google KMS transport SDKs with lightweight REST clients while retaining official credential discovery, signing, and token refresh libraries.
• Added packaging checks for protected API access, required security components, and production/test module isolation.
• Added native-library integrity verification and explicit control over system-library fallback. Fallback now requires -Dkeeper.native.allow-system=true for crypto libraries on Linux arm64 and macOS amd64.
• Standardized configuration timeouts on Duration and added deadlines for reading complete request bodies.

Smaller production artifacts

Like-for-like production builds targeting linux-amd64:

Configuration	Before	3.1.0	Reduction
ECC, no optional features	76.20 MiB	47.60 MiB	37.5%
ECC, all production features	110.76 MiB	57.30 MiB	48.3%