v0.1.0-alpha.266

What's Changed

• fix(#2039): run HTTP middleware around final dispatch by @jonesrussell in #2040
• feat(#2037): add application-secret HKDF custody by @jonesrussell in #2038
• feat(#2037): encrypt OIDC secrets at rest by @jonesrussell in #2041
• feat(#2037): authenticate persistent payloads by @jonesrussell in #2042
• feat(#2043): require deliberate entity API exposure by @jonesrussell in #2044
• feat(#1871): expose groups through permission-gated API by @jonesrussell in #2045
• fix(#2043): normalize boolean persistence shape by @jonesrussell in #2046

Full Changelog: v0.1.0-alpha.265...v0.1.0-alpha.266