feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

src/Concelier/StellaOps.Concelier.WebService/Options/ConcelierOptions.cs

@@ -9,6 +9,8 @@ public sealed class ConcelierOptions
 {
     public StorageOptions Storage { get; set; } = new();
 
+    public PostgresStorageOptions? PostgresStorage { get; set; }
+
     public PluginOptions Plugins { get; set; } = new();
 
     public TelemetryOptions Telemetry { get; set; } = new();
@@ -36,6 +38,63 @@ public sealed class ConcelierOptions
         public int CommandTimeoutSeconds { get; set; } = 30;
     }
 
+    /// <summary>
+    /// PostgreSQL storage options for the LNM linkset cache.
+    /// </summary>
+    public sealed class PostgresStorageOptions
+    {
+        /// <summary>
+        /// Enable PostgreSQL storage for LNM linkset cache.
+        /// When true, the linkset cache is stored in PostgreSQL instead of MongoDB.
+        /// </summary>
+        public bool Enabled { get; set; }
+
+        /// <summary>
+        /// PostgreSQL connection string.
+        /// </summary>
+        public string ConnectionString { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Command timeout in seconds. Default is 30 seconds.
+        /// </summary>
+        public int CommandTimeoutSeconds { get; set; } = 30;
+
+        /// <summary>
+        /// Maximum number of connections in the pool. Default is 100.
+        /// </summary>
+        public int MaxPoolSize { get; set; } = 100;
+
+        /// <summary>
+        /// Minimum number of connections in the pool. Default is 1.
+        /// </summary>
+        public int MinPoolSize { get; set; } = 1;
+
+        /// <summary>
+        /// Connection idle lifetime in seconds. Default is 300 seconds (5 minutes).
+        /// </summary>
+        public int ConnectionIdleLifetimeSeconds { get; set; } = 300;
+
+        /// <summary>
+        /// Enable connection pooling. Default is true.
+        /// </summary>
+        public bool Pooling { get; set; } = true;
+
+        /// <summary>
+        /// Schema name for LNM tables. Default is "vuln".
+        /// </summary>
+        public string SchemaName { get; set; } = "vuln";
+
+        /// <summary>
+        /// Enable automatic migration on startup. Default is false for production safety.
+        /// </summary>
+        public bool AutoMigrate { get; set; }
+
+        /// <summary>
+        /// Path to SQL migration files. Required if AutoMigrate is true.
+        /// </summary>
+        public string? MigrationsPath { get; set; }
+    }
+
     public sealed class PluginOptions
     {
         public string? BaseDirectory { get; set; }

src/Concelier/StellaOps.Concelier.WebService/Program.cs

@@ -57,6 +57,7 @@ using StellaOps.Concelier.RawModels;
 using StellaOps.Concelier.Storage.Mongo;
 using StellaOps.Concelier.Storage.Mongo.Advisories;
 using StellaOps.Concelier.Storage.Mongo.Aliases;
+using StellaOps.Concelier.Storage.Postgres;
 using StellaOps.Provenance.Mongo;
 using StellaOps.Concelier.Core.Attestation;
 using AttestationClaims = StellaOps.Concelier.Core.Attestation.AttestationClaims;
@@ -195,6 +196,25 @@ else
     builder.Services.RemoveAll<IMongoClient>();
     builder.Services.RemoveAll<IMongoDatabase>();
 }
+
+// Add PostgreSQL storage for LNM linkset cache if configured.
+// This provides a PostgreSQL-backed implementation of IAdvisoryLinksetStore for the read-through cache.
+if (concelierOptions.PostgresStorage is { Enabled: true } postgresOptions)
+{
+    builder.Services.AddConcelierPostgresStorage(pgOptions =>
+    {
+        pgOptions.ConnectionString = postgresOptions.ConnectionString;
+        pgOptions.CommandTimeoutSeconds = postgresOptions.CommandTimeoutSeconds;
+        pgOptions.MaxPoolSize = postgresOptions.MaxPoolSize;
+        pgOptions.MinPoolSize = postgresOptions.MinPoolSize;
+        pgOptions.ConnectionIdleLifetimeSeconds = postgresOptions.ConnectionIdleLifetimeSeconds;
+        pgOptions.Pooling = postgresOptions.Pooling;
+        pgOptions.SchemaName = postgresOptions.SchemaName;
+        pgOptions.AutoMigrate = postgresOptions.AutoMigrate;
+        pgOptions.MigrationsPath = postgresOptions.MigrationsPath;
+    });
+}
+
 builder.Services.AddOptions<AdvisoryObservationEventPublisherOptions>()
     .Bind(builder.Configuration.GetSection("advisoryObservationEvents"))
     .PostConfigure(options =>

src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj

@@ -9,7 +9,7 @@
     <RootNamespace>StellaOps.Concelier.WebService</RootNamespace>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0-rc.2.25502.107" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0" />
     <PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.12.0" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
     <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.12.0" />
@@ -24,6 +24,7 @@
   <ItemGroup>
     <ProjectReference Include="../__Libraries/StellaOps.Concelier.Core/StellaOps.Concelier.Core.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj" />
+    <ProjectReference Include="../__Libraries/StellaOps.Concelier.Storage.Postgres/StellaOps.Concelier.Storage.Postgres.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Concelier.Merge/StellaOps.Concelier.Merge.csproj" />