Release v6.0.9 - fix(security): strip cross-credential headers in auth middlewares (CC-1, MR !23) Closes the audit's fleet-wide x-api-key/Bearer mix bypass: Bearer-authenticated request with arbitrary x-api-key header no longer short-circuits TransactionFlow's authorizationRules() via Base::usesApiKey(). - chore(auth): drop dead is_user / remember_token from IdentityBase / Token (verified zero callers cluster-wide on 2026-05-07)