#723 Improve database work claiming, numeric handling and JWT configuration

Upstream Updates

• tymondesigns/jwt-auth #2304: rebuild signing configuration on first use after boot-time settings change. Setting an algorithm before its keys now works, while invalid configuration remains a configuration error. Preserve parsed-key reuse, custom constraints and verification-only providers.
• laravel/docs #11415 and its formatting update: document AI stopping middleware, classification model selection and the sub-agent approval limitation, retaining Hypervel's batched streaming updates.
• laravel/docs #11416 and #11422: explain MCP OAuth registration and Hypervel's automatic rate limiting, and warn against user-selected upload filenames and embedded code in otherwise valid images.
• inertiajs/docs #95: document initial-page component preloading and limiting Link headers, with Hypervel middleware and reverse-proxy examples.

Additional Hypervel Fixes

• Add fluent skipLocked() support and connection-owned capability detection. Queue and outbox workers can skip locked rows on supported databases without duplicating version checks.
• Apply supported index hints to writes and retain outbox ownership and eligibility conditions when claiming or deleting records. Keep claims bounded instead of broadening the locked selection.
• Preserve coroutine cancellation through transaction callbacks, pruning and pooled-connection cleanup, including cancellation carried by a cleanup exception.
• Restore cached in-memory SQLite databases through the physical test pool before installing refresh hooks. Document the single-session limit of in-memory SQLite pools.
• Preserve exact numeric tokens when decoding JSON. Bound scientific-notation exponent expansion in decimal casts and numeric validation while retaining ordinary decimal precision and consistent compiled-validation behavior.
• Add configurable releasePadding() to rate-limited queue jobs, preserving explicit retry delays.
• Clear stale Eloquent cast caches when raw attributes are replaced, preserve immutable date return types, and correct model-specific builder, collection and paginator types.
• Record the separate cancellation audit and dependency follow-ups, and document the new database and queue behavior.

Affected tests, source and type-fixture analysis, skeleton analysis and formatting pass. The JWT setter regression fails before the correction and passes afterward. The full suite and database matrix run in CI.

[!NOTE]

Improve database work claiming, cancellation handling, numeric validation, and JWT config

• Adds a boolean skipLocked() query builder flag with SKIP LOCKED SQL compilation for MySQL/MariaDB/PostgreSQL. Connection::supportsSkipLocked() replaces PdoConnection::lockForPopping() as the capability check, and the outbox and queue claim paths now use lockForUpdate()->skipLocked() with retrying claims (see DatabaseOutboxRepository.php).
• Index hints now apply to MySQL/MariaDB/SQLite update and delete queries through compileTableWithIndexHint() and the new hinted-delete compiler in MySqlGrammar.php.
• Replaces direct CanceledException catches with Coroutine::causedByCancellation() across database transactions, connection pools, connection leases, and pruning, so wrapped cancellations are recognized and rethrown.
• Numeric validation and decimal casts enforce a scientific-notation exponent limit (±1000 via Number::MAX_EXPONENT), throwing MathException past the bound; multiple_of failures return false instead of throwing. Adds Json::decodeNumbersAsStrings() and configurable releasePadding() on queue rate limiting.
• JWT Lcobucci provider now lazily builds and caches its configuration, invalidating it on algorithm/secret/key changes so runtime reconfiguration works (Lcobucci.php).
• Risk: MySqlConnection::resolveSupportsSkipLocked() and PdoConnection::supportsSkipLocked() rename the public lockForPopping() API; any out-of-tree callers or custom Connection subclasses relying on the old method or lock-clause result must be updated. RateLimited retry delay now uses the serialized releasePadding (default 3s, previously hard-coded).

^{Macroscope summarized f32b84a.}

Summary by CodeRabbit

• New Features
  • Added SKIP LOCKED support for compatible databases and expanded index-hint support for updates and deletes.
  • Added configurable retry-delay padding for rate-limited jobs and JSON decoding that preserves numeric tokens exactly.
  • Improved pooled in-memory SQLite restoration for database tests and made JWT configuration changes take effect on subsequent use.
• Bug Fixes
  • Improved cancellation propagation across database operations and cleanup, preventing cancellation-related retries.
  • Decimal casts and validation now handle precision and exponent limits more consistently.
  • Improved concurrent outbox claiming and processing to reduce conflicts when multiple workers operate at once.
• Documentation
  • Expanded guidance for query locking, file uploads, Inertia asset preloading, AI workflows, and database testing.