Release v6.0.9

- fix(security): strip cross-credential headers in auth middlewares (CC-1, MR !23)
  Closes the audit's fleet-wide x-api-key/Bearer mix bypass: Bearer-authenticated
  request with arbitrary x-api-key header no longer short-circuits
  TransactionFlow's authorizationRules() via Base::usesApiKey().
- chore(auth): drop dead is_user / remember_token from IdentityBase / Token
  (verified zero callers cluster-wide on 2026-05-07)