docs(release): v2.4.0 CHANGELOG + docs pages for new features

[thegdsks]

Summary

• Adds ## [2.4.0] - 2026-06-22 section to CHANGELOG.md covering PRs chore(release): automated signed releases with SBOM + SLSA provenance #57-chore(fmt): gofmt -w on jwtbearer.go + par_serialise.go #68, grouped by Added / Changed / Fixed / Tests / Internal / Security.
• Adds 9 new docs pages and updates 5 existing ones for every v2.4 feature.
• Updates mkdocs.yml nav to include all new pages.
• mkdocs build --strict passes.
• go test -race ./... passes.
• Zero em dashes or en dashes.

New docs pages

Page	PR covered
concepts/par-jar.md	#64 (PAR RFC 9126, JAR RFC 9101, FAPI 2.0 narrative)
concepts/jwt-bearer.md	#65 (RFC 7523, k8s ServiceAccount use case)
concepts/ciba.md	#66 (RFC 9509, Poll + Ping modes, AuthenticationDevice interface)
guides/migrate-from-cognito.md	#63 (snippet from docs/MIGRATING-FROM-COGNITO.md)
guides/migrate-from-auth0.md	#63 (snippet from docs/MIGRATING-FROM-AUTH0.md, bcrypt fallback)
security/compliance-soc2.md	#61 (snippet from docs/COMPLIANCE-SOC2.md)
security/compliance-gdpr.md	#61 (snippet from docs/COMPLIANCE-GDPR.md)
migrations/v2.3-to-v2.4.md	All (additive upgrade guide, opt-in knobs)

Updated docs pages

Page	What changed
getting-started/storage-backends.md	Added MySQL 8.x section: constructor, migrations, THEAUTH_MYSQL_CONTRACT=1 gate, parity caveats
reference/configuration.md	Added PAR, JAR, JWTBearer, CIBA, RequireState, PasswordPolicy.AllowLegacyBcrypt
reference/storage.md	Added mysql to adapter table, expanded storagetest conformance suite section (12 areas)
security/threat-model.md	Added admonition linking to full STRIDE doc in repo
security/releases.md	Added "Operational since v2.4.0" admonition confirming goreleaser/cosign/SLSA are live

Deferred

No pages were stubbed or deferred. All requested pages ship with full content.

Test plan

• go test -race -count=1 ./... passes
• go vet ./... passes
• gofmt -l . reports no files
• mkdocs build --strict passes
• Zero em dashes / en dashes in *.md and *.yml

[github-actions]

Benchmark regression report

Threshold: 25%

goos: linux
goarch: amd64
pkg: github.com/glincker/theauth-go
cpu: AMD EPYC 9V74 80-Core Processor                
                     │ base-bench.txt │         pr-bench.txt          │
                     │     sec/op     │   sec/op     vs base          │
RateLimitReadHeavy-4      75.76n ± 1%   76.02n ± 1%  ~ (p=0.469 n=10)

                     │ base-bench.txt │          pr-bench.txt          │
                     │      B/op      │    B/op     vs base            │
RateLimitReadHeavy-4       0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

                     │ base-bench.txt │          pr-bench.txt          │
                     │   allocs/op    │ allocs/op   vs base            │
RateLimitReadHeavy-4       0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

pkg: github.com/glincker/theauth-go/crypto
               │ base-bench.txt │            pr-bench.txt            │
               │     sec/op     │   sec/op     vs base               │
Argon2Hash-4        53.43m ± 1%   53.75m ± 3%       ~ (p=0.190 n=10)
Argon2Verify-4      53.26m ± 2%   52.98m ± 1%       ~ (p=0.481 n=10)
geomean             53.34m        53.36m       +0.03%

               │ base-bench.txt │            pr-bench.txt             │
               │      B/op      │     B/op      vs base               │
Argon2Hash-4       64.01Mi ± 0%   64.01Mi ± 0%       ~ (p=0.617 n=10)
Argon2Verify-4     64.01Mi ± 0%   64.01Mi ± 0%       ~ (p=0.752 n=10)
geomean            64.01Mi        64.01Mi       +0.00%

               │ base-bench.txt │           pr-bench.txt            │
               │   allocs/op    │ allocs/op   vs base               │
Argon2Hash-4         102.0 ± 1%   102.0 ± 0%       ~ (p=0.628 n=10)
Argon2Verify-4       103.0 ± 1%   103.0 ± 1%       ~ (p=1.000 n=10)
geomean              102.5        102.5       +0.00%

pkg: github.com/glincker/theauth-go/internal/bench
                               │ base-bench.txt │            pr-bench.txt            │
                               │     sec/op     │   sec/op     vs base               │
AuditRedactor-4                     1.377µ ± 1%   1.378µ ± 1%       ~ (p=0.724 n=10)
OAuthCallback-4                     989.2n ± 0%   994.6n ± 1%       ~ (p=0.289 n=10)
OAuthCodeFlow-4                     50.76µ ± 2%   50.84µ ± 1%       ~ (p=0.796 n=10)
OAuthTokenEndpointRefreshHit-4      51.40µ ± 1%   51.52µ ± 1%       ~ (p=0.912 n=10)
JWKSEndpoint-4                      6.435µ ± 2%   6.371µ ± 1%       ~ (p=0.190 n=10)
SCIMTokenAuth-4                     16.35µ ± 2%   15.67µ ± 2%  -4.12% (p=0.000 n=10)
SessionLookup-4                     8.866µ ± 2%   8.945µ ± 3%  +0.89% (p=0.043 n=10)
geomean                             8.541µ        8.500µ       -0.48%

                               │ base-bench.txt │             pr-bench.txt              │
                               │      B/op      │     B/op      vs base                 │
AuditRedactor-4                      672.0 ± 0%     672.0 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCallback-4                    1.344Ki ± 0%   1.344Ki ± 0%       ~ (p=1.000 n=10) ¹
OAuthCodeFlow-4                    15.79Ki ± 0%   15.79Ki ± 0%       ~ (p=0.998 n=10)
OAuthTokenEndpointRefreshHit-4     15.55Ki ± 0%   15.55Ki ± 0%  +0.01% (p=0.033 n=10)
JWKSEndpoint-4                     2.963Ki ± 0%   2.963Ki ± 0%       ~ (p=0.211 n=10)
SCIMTokenAuth-4                    9.765Ki ± 0%   9.765Ki ± 0%  +0.01% (p=0.024 n=10)
SessionLookup-4                    8.451Ki ± 0%   8.451Ki ± 0%       ~ (p=1.000 n=10)
geomean                            4.729Ki        4.730Ki       +0.00%
¹ all samples are equal

                               │ base-bench.txt │            pr-bench.txt             │
                               │   allocs/op    │ allocs/op   vs base                 │
AuditRedactor-4                      4.000 ± 0%   4.000 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCallback-4                      5.000 ± 0%   5.000 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCodeFlow-4                      100.0 ± 0%   100.0 ± 0%       ~ (p=1.000 n=10) ¹
OAuthTokenEndpointRefreshHit-4       100.0 ± 0%   100.0 ± 0%       ~ (p=1.000 n=10) ¹
JWKSEndpoint-4                       37.00 ± 0%   37.00 ± 0%       ~ (p=1.000 n=10) ¹
SCIMTokenAuth-4                      56.00 ± 0%   56.00 ± 0%       ~ (p=1.000 n=10) ¹
SessionLookup-4                      42.00 ± 0%   42.00 ± 0%       ~ (p=1.000 n=10) ¹
geomean                              29.04        29.04       +0.00%
¹ all samples are equal

pkg: github.com/glincker/theauth-go/internal/jwt
            │ base-bench.txt │            pr-bench.txt            │
            │     sec/op     │   sec/op     vs base               │
JWTSign-4        33.11µ ± 0%   33.31µ ± 0%  +0.62% (p=0.001 n=10)
JWTVerify-4      77.63µ ± 1%   77.76µ ± 1%       ~ (p=0.190 n=10)
geomean          50.70µ        50.90µ       +0.40%

            │ base-bench.txt │             pr-bench.txt              │
            │      B/op      │     B/op      vs base                 │
JWTSign-4       2.782Ki ± 0%   2.782Ki ± 0%       ~ (p=1.000 n=10) ¹
JWTVerify-4     3.422Ki ± 0%   3.422Ki ± 0%       ~ (p=1.000 n=10) ¹
geomean         3.086Ki        3.086Ki       +0.00%
¹ all samples are equal

            │ base-bench.txt │            pr-bench.txt             │
            │   allocs/op    │ allocs/op   vs base                 │
JWTSign-4         15.00 ± 0%   15.00 ± 0%       ~ (p=1.000 n=10) ¹
JWTVerify-4       61.00 ± 0%   61.00 ± 0%       ~ (p=1.000 n=10) ¹
geomean           30.25        30.25       +0.00%
¹ all samples are equal

Generated by the bench workflow. A + delta means the PR branch is slower.