@spec cleanup_expired_authorizations() :: {:ok, non_neg_integer()} | {:error, term()}

Deletes expired and consumed authorization candidates.

Credential columns are wiped before the rows are deleted, so token ciphertext never outlives the candidate even if deletion is delayed. Consumed candidates already have their tokens cleared by finalization; expired candidates that were never consumed are marked consumed as they are wiped. When anything was deleted, a :session_expired audit entry records the count and cleanup type only: no handle, token, or claim data.

Returns {:ok, deleted_count}.

@spec multi_consume_authorization(
  Ecto.Multi.t(),
  term(),
  binary(),
  binary(),
  keyword()
) ::
  Ecto.Multi.t()

Atomically consumes a verified authorization and returns its safe identity proof.

The named Multi step creates no connection. Host writes and credential erasure commit together, so a later step's failure leaves the authorization reusable.

Verifies a staged candidate and stores only its safe identity proof.

Exchanges a claimed OAuth session into an encrypted, short-lived candidate.

Verifies and, when absent, binds the subject of an active connection.