[batteryshark]

Security hardening for SPS (Secrets Procurement Service).

What changes

• Grant policy: a registration may only bind its own item by default; other items need an explicit [grants] entry in the SPS config. Registrations are audited with hashed field/item and entry counts.
• Audit retention: ping and malformed traffic no longer write a line per event (rate-bounded counters instead); several rotated generations are kept.
• TLS handshake has an absolute deadline.
• Provider errors on the bulk read path are reported as backend errors; unknown tool ids answer like a wrong credential; credentials are hidden from repr; vault-set/vault-get honour the passphrase file; written values are capped (64 KiB default, configurable); non-loopback binds need an explicit flag; new vaults use a stronger KDF (existing vaults unchanged); longer self-signed certificate validity with an expiry warning; the tool SDK refuses the fake path when a real tool credential is present.

Upgrade notes

• Cross-tool item bindings and non-loopback SPS binds now need explicit configuration.
• Existing vaults and certificates keep working.