Audit and recovery

Review attribution without secret values. Repair when refs drift from the vault.

Use authsia doctor when setup looks stale, and authsia lock to end sessions.