9a935bb: Backdating moves into the SDK: createApp({ backdating }) lets a test tenant run a request on a past clock (RAD-311).

Opt in with backdating: true (every POST/PUT/PATCH/DELETE route accepts at in its body) or { routes, exclude, strip } (per-route field aliases in precedence order, at appended last; routes never backdated; remove the fields from c.body on a backdated request). The moment is honoured only when the x-revenexx-tenant header equals the tenant_id claim of the forwarded identity token and the tenant's allow_backdating setting is true (or the text "true"); unreadable settings fall back to the declared default, off. Without the gate the field is ignored, unread and unvalidated. With it the moment must be an ISO 8601 date-time with a zone, not in the future and at most 24 months back, else 400 backdating_invalid. The whole handler runs on the moment: c.now(), c.clock() and the exported now(), clock(), backdated(); runAt() sets the clock outside a route. backdatingDb(db, ENTITIES) wraps the generated data client and stamps created_at / updated_at on rows created inside a backdated request, keeping values the caller set. Also exported: parseBackdate, backdatingAllowed, MAX_MONTHS_BACK, BACKDATING_SETTING, BACKDATING_FIELD, BACKDATING_INVALID. Apps that do not opt in are unchanged.

@revenexx/app-sdk@1.4.0