Changes touching this path

• private api answers carry a Server-Timing header from withPrivateSession, recorded by the new site/src/server/timing.ts: each timed step names itself where it is written, the session verify as verify.pem or verify.jwks and each pool wait and statement as identity, owner, member or membership .wait and .query, each name with its summed duration and run count, then total. a private request looks its account up once through the new sessionAccount, where /repo had looked it up 2 or 3 times and /repos once plus once per key. clerk.ts verifies over CLERK_JWT_KEY, the instance public key, when it is set: without it @clerk/backend refetches the JWKS whenever its copy is 5 minutes old, 12 fetches over a simulated hour at one request every 30 s against at most one per key id with the key, so the clerk.ts header claim of a networkless verify was false and is corrected, as is docs/specs/loot-forge.md. a key id goes to the static key only after a token under it verified over the JWKS, since Clerk files the static key under any key id a token names, in an unbounded cache, before the signature check; a signature the static key refuses goes to the JWKS, refetched at most once a minute, and a key id the JWKS then verifies stays with the JWKS and warns once, so a changed instance key keeps verifying under a new or the same key id, and a refusal on a claim never falls back. measured on a local Postgres through the live suites, the database side of an owned or a member repo read took 1.7 ms with one identity query, and the verify costs about 150 us in process over either key. pinned in private-timing (9 tests), clerk-verify (8) and one test each in owner.pg and member.pg. red under named mutations, each restored: the account looked up per ask (5 failed and 4 passed of 9, and 1 failed and 89 passed over the live suites), the header dropped (3 and 6), the static key for an unlearned key id (5 and 3 of 8), fallback on any refusal (1 and 7), no fallback (5 and 3), no demotion to the JWKS (2 and 6), no forced refetch (2 and 6), refetch unbounded (1 and 7), CLERK_JWT_KEY ignored (6 and 2), escaped line breaks kept (4 and 4). cargo test green, 4831 passed over 144 test result lines with 15 ignored, the site gate green at 909 passed, and the site live suites 90 passed through ci/local.sh. CONTEXT.md gains Private request timing. owes a site deploy, which should set CLERK_JWT_KEY in the site env half (uyzzknlm) 3cfbe0dd · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.