muster release v5.34.6

The Valkey token store no longer keeps every forwarded ID token. The per-person revocation index kept each token issued within its TTL, the ID tokens a portal session forwarded as raw JWTs among them, so an active user’s index only grew. mcp-oauth v1.4.12 prunes expired entries on every write and stores an ID token as its digest.
A Dex outage during a token refresh no longer signs the person out. A refresh that met Dex answering 503, 429 or not at all was answered invalid_grant, so a client such as the Slack gateway dropped the person’s link. muster now answers 503 temporarily_unavailable with Retry-After (mcp-oauth v1.4.13), and the same refresh token works once Dex answers.