feat(core): FK for user_id columns; MCP search requires user

- Add fk_entries_user_id, fk_entries_history_user_id, fk_audit_log_user_id (ON DELETE SET NULL)
- Add scripts/cleanup-orphan-user-ids.sql for pre-deploy orphan user_id cleanup
- Remove deprecated SERVER_MASTER_KEY / per-user key wrap helpers from secrets-core
- secrets-mcp: require authenticated user for secrets_search; improve body-read failure response
- Bump secrets-mcp to 0.2.1

Made-with: Cursor

crates/secrets-mcp/src/logging.rs

@@ -5,11 +5,11 @@ use axum::{
     body::{Body, Bytes, to_bytes},
     extract::{ConnectInfo, Request},
     http::{
-        HeaderMap, Method,
+        HeaderMap, Method, StatusCode,
         header::{CONTENT_LENGTH, CONTENT_TYPE, USER_AGENT},
     },
     middleware::Next,
-    response::Response,
+    response::{IntoResponse, Response},
 };
 
 /// Axum middleware that logs structured info for every HTTP request.
@@ -68,10 +68,23 @@ pub async fn request_logging_middleware(req: Request, next: Next) -> Response {
                 }
                 Err(e) => {
                     tracing::warn!(path, error = %e, "failed to buffer MCP request body for logging");
-                    // Reconstruct with empty body; request was consumed — return 500.
-                    // This branch is highly unlikely in practice.
-                    let resp = next.run(Request::from_parts(parts, Body::empty())).await;
-                    return resp;
+                    let elapsed = start.elapsed().as_millis();
+                    tracing::info!(
+                        method = method.as_str(),
+                        path,
+                        status = StatusCode::INTERNAL_SERVER_ERROR.as_u16(),
+                        elapsed_ms = elapsed,
+                        client_ip = ip.as_deref(),
+                        ua = ua.as_deref(),
+                        content_length = content_len,
+                        mcp_session = mcp_session.as_deref(),
+                        "mcp request",
+                    );
+                    return (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        "failed to read request body",
+                    )
+                        .into_response();
                 }
             }
         }