security(preauth): version the SDK key format

[pierrick-fonquerne]

Severity

Low to medium. Forward-looking robustness for the SDK key shape validation shipped in #134.

Problem

The pre-auth SDK key shape check rejects impossible keys by a fixed structure (a sv_ or cl_ prefix followed by 48 hex characters, 51 bytes total) before any database lookup. The format carries no explicit version marker, so a future change to key length, prefix set or encoding cannot be rolled out without ambiguity between old and new keys, and cannot be validated cheaply on the pre-auth path.

Acceptance criteria

• The SDK key format carries an explicit version marker that the shape check can read without a database lookup.
• The pre-auth shape check accepts the current version and has a defined policy for unknown or future versions.
• A migration path for introducing a new key version is documented, including how old and new keys coexist.
• Tests cover current-version acceptance and unknown-version rejection, both before any database lookup.