store: ids are reused after a hard delete; audit signed values that name them #306

repos.id and users.id (and most tables) are INTEGER PRIMARY KEY without AUTOINCREMENT and rows are hard-deleted, so deleting the newest repository or account lets the next one take its id. The #295 review found a reply-by-mail token bound to a deleted repository posting into the new one with the same id; that path now checks created_at against the token's mint time.

Other signed or cached values that name an id need the same check or a non-reused id:

• LFS tokens (repo:key:keypin:op:exp; the key pin covers the key, not the repository)
• web session and login-link rows, push device tokens, webhook delivery rows, cursors
• anything in the audit log or notifications that is later resolved by id

Options: AUTOINCREMENT on the parent tables (a migration per table), or a created_at / generation check wherever a stored or signed id is resolved.