chore(deps): bump github.com/bds421/rho-kit/data/v2 from 2.0.2 to 2.1.0 in /repos/postgres

[dependabot]

Bumps github.com/bds421/rho-kit/data/v2 from 2.0.2 to 2.1.0.

Release notes

Sourced from github.com/bds421/rho-kit/data/v2's releases.

rho-kit v2.1.0 — external API keys

v2.1.0 — external API keys

Adds first-class support for opaque, customer-facing API keys — the convention OpenAI, Anthropic, Stripe and GitHub use — composed entirely from existing kit primitives (stdlib + core/* + authz), no new third-party dependencies.

New

Module	What
security/apikey	Pure core: Generate / Hash (SHA-256) / Verify (constant-time, expiry + revocation), sentinel errors, scopes, root/api Kind, in-memory Repository, and a Manager for issue / rotate-with-overlap / revoke.
data/apikey/postgres	pgx-backed Repository — lookup by indexed id, soft-delete revocation, embedded migration.
httpx/middleware/apikey	Bearer / X-API-Key authentication → request-context identity + scopes (401s that don't leak which ids exist), plus RequireScopes validated against the authz registry at startup (403 on mismatch).
app/apikey	Lazy app.Module wiring the middleware at PhaseAuth.

Design

• Opaque keys, not JWTs — instantly revocable, long-lived; pick these for external/AI-agent access. (Stateless signed tokens remain available via app/paseto for your own short-lived sessions.)
• SHA-256 lookup hash, not a password KDF — the secret already carries 256 bits of entropy, so argon2/bcrypt would add cost without security and break lookup-by-hash. Never run keys through crypto/passhash.
• Token format <prefix>_<id>_<secret> (e.g. rho_018f…_3kQ9…): the public id is the indexed lookup key; only the SHA-256 hash is stored; the plaintext is shown to the owner exactly once.
• Rotation overlap falls out of the existing revoke path — Rotate schedules the old key's revocation at now + overlap.

Docs & examples

• docs/ai/security.md — full "API Keys (Opaque, External-Facing)" recipe.
• examples/api-gateway — /api/keys-demo route showing issue → authenticate → scope-check end to end.

Compatibility

Purely additive. New leaf modules join the lockstep /v2 train; every workspace module is tagged v2.1.0. No breaking changes to existing APIs. Also folds in the dependency bumps from #71 and #73 and the saga resume fix from #72.

Commits

• 9a5b0f3 feat(apikey): add external/customer API key support
• ad0dad1 chore(deps)(deps): bump the go-deps-minor-patch group with 15 updates (#73)
• e963d52 fix(saga): resume in-flight sagas concurrently (bounded) (#72)
• f26011a chore(deps)(deps): bump the go-deps-minor-patch group with 8 updates (#71)
• da1e1c2 docs(release): promote release-version.sh to repo-tracked tool
• adb9d6b release: prepare v2.0.2 module level 7
• fcdda15 release: prepare v2.0.2 module level 6
• 8467637 release: prepare v2.0.2 module level 5
• 7bb6952 release: prepare v2.0.2 module level 4
• 8fa8bbe release: prepare v2.0.2 module level 3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)