crypto: harden API surface

Make it explicit that expiration is not being tested with Decrypt, and
test that the expiration is meaningful with DecryptWithExpiration.

Fetch user PGP key for meta.sr.ht

Correct TODO for context which is invariant

Prohibit OAuth client auth for revoked clients

Print IP with "invalid source IP" authError

Add legacy webhooks worker implementation

Add test for internal auth

Add basic auth tests

auth/middleware: fix printf suspension params

Import GQL server interfaces from gql.sr.ht