chore(main): release 1.16.9

[github-actions]

🤖 I have created a release beep boop

1.16.9 (2026-04-22)

Bug Fixes

• async scrypt + VALID_PERMISSIONS constant in apiKeyUtils (405a0aa)
• Auth Doc and Swagger Updates (922cbdf)
• clone now for oneYearFromNow to avoid date-boundary drift (0c791bd)
• derive API key encryption key via scrypt (2b71267)
• documentation (bf10031)
• loop-based generateApiKey + JSDoc Promise return types (c1d3725)
• mark hashApiKey and validateApiKey as async (f1088e4)
• more minor spelling and swagger changes (637e3b2)
• repair broken temp API key auth + DRY encryption helpers (ee82cb6)
• validate decryptFullKey input shape + simplify generateApiKey (69dcade)
• validate expiration dates against Invalid Date inputs (8368b53)
• validate jwt_secret in deriveEncryptionKey (6655c22)
• various code quality reliability issues and swagger issues (c7f3f65)
• vulnerability and AI quality assessments (d9dbb72)
• wrap encryptFullKey and decryptFullKey crypto ops in try/catch (41120b9)

Documentation

• add JSDoc to validatePermissions, validateExpirationDate, isApiKeyExpired (1991583)
• explain why apiKeyUtils skips some input validation (9326a3a)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v1.16.9

🌻