[P2] Clean up expired OAuth states and connection credentials

[michielbdejong]

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

oauth_states and connection_codes retrieval deletes only a matching unexpired row. Expired or abandoned records have no cleanup path and can accumulate indefinitely. Handoffs and consumed challenges have cleanup logic, so the retention behavior is inconsistent.

Evidence

• src/security.rs:124
• src/security.rs:170

Desired outcome

Add expiry cleanup and suitable indexes for these tables. Verify abandoned and expired rows are eventually removed without deleting live records.

[michielbdejong]

Fixed in #73 — oauth_states and connection_codes now get the same opportunistic DELETE ... WHERE expires_at <= NOW() cleanup already used for used_challenges/connection_handoffs, plus supporting indexes on expires_at.

---

Generated by Claude Code