fix: quota pending sign-ins and registrations per address, keep young clients, write the store off the loop (SEC-09)

src/aegis_gitea_mcp/oauth/store.py

@@ -40,6 +40,7 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any, Literal
 
+import anyio.to_thread
 from cryptography.fernet import Fernet, InvalidToken
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
@@ -272,7 +273,10 @@ class OAuthStore:
         """Prune expired entries and persist the state atomically (encrypted, mode 0600)."""
         async with self._lock:
             self.prune()
-            self._write(self._fernet.encrypt(self._document()))
+            data = self._fernet.encrypt(self._document())
+            # The write fsyncs: keep that off the event loop (the bytes are already built,
+            # so the thread touches no shared state).
+            await anyio.to_thread.run_sync(self._write, data)
 
     # Maintenance