feat: support permanent credentials and overlapping token rotation

internal/storage/mysql/baseline.sql

@@ -1,4 +1,4 @@
--- Orbit fresh-install baseline, generated from migration version 31.
+-- Orbit fresh-install baseline, generated from migration version 32.
 -- This file intentionally contains no database-level relation constraints.
 CREATE TABLE `orbit_application_resources` (
   `application_id` binary(16) NOT NULL COMMENT '所属应用标识及主键，跨命名空间共享额度',
@@ -59,12 +59,15 @@ CREATE TABLE `orbit_credentials` (
   `updated_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) COMMENT '最后写入时间，统一 UTC；不能代替并发版本',
   `name` varchar(128) COLLATE utf8mb4_0900_as_cs NOT NULL COMMENT '可读名称，唯一性范围由对应数据表约束',
   `secret_digest` binary(32) NOT NULL COMMENT '凭据秘密的 SHA-256 摘要，不保存或输出原文',
+  `previous_secret_digest` binary(32) DEFAULT NULL COMMENT '上一代秘密的 SHA-256 摘要；为空表示无过渡令牌，不保存原文',
+  `previous_valid_until` datetime(6) DEFAULT NULL COMMENT '上一代令牌过渡截止，UTC；不晚于其原到期时间，与旧摘要同时为空或非空',
   `permissions` json NOT NULL COMMENT '授权范围的 JSON 快照，必须由服务端解释和校验',
   `expires_at` datetime(6) DEFAULT NULL COMMENT '凭据过期时间，统一 UTC；为空表示没有配置到期时间',
   `revoked_at` datetime(6) DEFAULT NULL COMMENT '撤销时间；为空表示尚未撤销',
   PRIMARY KEY (`namespace_id`,`id`),
   UNIQUE KEY `uq_credential_name` (`namespace_id`,`name`),
-  CONSTRAINT `ck_orbit_credentials_0` CHECK ((`revision` > 0))
+  CONSTRAINT `ck_orbit_credentials_0` CHECK ((`revision` > 0)),
+  CONSTRAINT `ck_credential_overlap` CHECK ((previous_secret_digest IS NULL AND previous_valid_until IS NULL) OR (previous_secret_digest IS NOT NULL AND previous_valid_until IS NOT NULL))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_as_cs COMMENT='命名空间凭据，只保存秘密摘要和授权范围';
 CREATE TABLE `orbit_deliveries` (
   `namespace_id` binary(16) NOT NULL COMMENT '资源所属命名空间，参与主键、授权与关联校验',