Release/0.2.0 - #5

Summary by cubic

Adds authenticated identity flow for LOGON. Validators now return AuthInfo, backends receive it via BoltBackend::set_session_auth(), and the server can signal credentials_expired; also adds BoltError::Forbidden and bumps to v0.2.0.

• New Features

  • AuthInfo { principal, credentials_expired } returned from LOGON validation.
  • Backend hook set_session_auth() invoked after successful LOGON.
  • LOGON Success may include credentials_expired: true.
  • New BoltError::Forbidden mapped to Neo.ClientError.Security.Forbidden.

• Migration

  • Change AuthValidator::validate to return Result<AuthInfo, BoltError>.
  • Set credentials_expired in AuthInfo when appropriate; clients can read it from LOGON Success metadata.
  • Optionally implement set_session_auth() to attach identity/roles to sessions.

^{Written for commit bd63df0. Summary will update on new commits.}