feat: support permanent credentials and overlapping token rotation

internal/storage/mysql/migrations/000032_credential_overlap.up.sql

@@ -0,0 +1,5 @@
+-- 同一凭据最多保留一代旧秘密；截止时间由轮换事务固定，不依赖节点内存。
+ALTER TABLE orbit_credentials
+  ADD COLUMN previous_secret_digest BINARY(32) NULL COMMENT '上一代秘密的 SHA-256 摘要；为空表示无过渡令牌，不保存原文',
+  ADD COLUMN previous_valid_until DATETIME(6) NULL COMMENT '上一代令牌过渡截止，UTC；不晚于其原到期时间，与旧摘要同时为空或非空',
+  ADD CONSTRAINT ck_credential_overlap CHECK ((previous_secret_digest IS NULL AND previous_valid_until IS NULL) OR (previous_secret_digest IS NOT NULL AND previous_valid_until IS NOT NULL));