fix: enable autocomplete in totp verification

totp: let legacy sessions disable totp

plc: always keep signing key in rotationKeys

fix(api): dont verify signature or DID during importRepo

feat(test): test that websockets get closed

feat(tranquil-store): gc and hardening