Fix stale OCSP snapshots indefinitely

- Parse and validate  from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs  in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused  from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat

Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.

README.md

@@ -158,8 +158,11 @@ bucket and ships a standalone Rust/Axum responder on port `2560`.
   CA.
 - Each CA snapshot is cached for one second with a single-flight refresh, so
   concurrent requests cause at most one S3 `GetObject` per CA per second.
-- If S3 is unavailable, a stale snapshot is served within the configured grace
-  period; otherwise the responder returns `tryLater`.
+- The publisher refreshes unchanged snapshots every 30 seconds by default. The
+  responder rejects snapshots older than its configured grace period even when
+  S3 is readable, and returns `tryLater` when no fresh snapshot is available.
+- OCSP `thisUpdate` reflects the snapshot generation time and `nextUpdate` never
+  extends beyond the snapshot's hard expiry.
 - Gitea Actions publishes `gitea.woggioni.net/woggioni/kca-ocsp` on the same
   `release/*` tags as the server image. The responder image is a statically
   linked musl executable running `FROM scratch` with only the CA bundle.