fix: make authentication persistence atomic

[cloudcarver]

Summary

• persist opaque-key expiry and enforce it in database reads and consumes
• atomically consume refresh tokens and create replacement token pairs in one transaction
• add a database uniqueness constraint for usernames and map conflicts to HTTP 409
• invalidate legacy keys safely during migration
• add concurrent replay, expiry-without-worker, and concurrent sign-up coverage

Validation

• go test ./...
• go test -race ./pkg/auth ./pkg/macaroons/... ./pkg/service ./pkg/controller
• go test -tags smoke -count=1 -run TestAuthAPI... ./e2e
• go vet ./...

Closes #33
Closes #34
Closes #53