ISO mdoc Device Response Builder

Part of Epic #13

### Description

Implement a `PresentationFactory` for the ISO mdoc credential format, analogous to the existing SD-JWT `SdJwtPresentation`.

The mdoc presentation builder must:

1. Parse the stored mdoc credential (CBOR-encoded).
2. Apply selective disclosure: include only the `IssuerSignedItem`s for the requested namespaces and data elements from the DCQL query.
3. Construct a `DeviceAuth` (device signature) using the tenant's holder key, binding the presentation to the verifier's session transcript.
4. Build the `DeviceResponse` CBOR structure per ISO 18013-5 §8.3.2.1.
5. Base64url-encode the CBOR for transport as a `Presentation::String`.

### File Placement

`crates/cloud-wallet-openid4vc/src/oid4vp/presentation/formats/mdoc.rs`
(Register in `formats/mod.rs`.)

### Spec References

- [ISO/IEC 18013-5:2021 §8.3.2.1 — Device retrieval](https://www.iso.org/standard/69084.html)
- [ISO/IEC 18013-5:2021 §9.1.3.6 — DeviceAuth](https://www.iso.org/standard/69084.html)
- [OpenID4VP Appendix B.4 — mso_mdoc](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#appendix-B.4)

### Acceptance Criteria

- [ ] `MdocPresentation` struct implementing `PresentationFactory`.
- [ ] Builder pattern mirroring `SdJwtPresentationBuilder`.
- [ ] Selective disclosure: namespace/element filtering from DCQL `claims`.
- [ ] `DeviceAuth` construction with `DeviceSignature` (COSE_Sign1) using holder key.
- [ ] Session transcript construction per OID4VP Appendix B.4.
- [ ] CBOR serialization of the complete `DeviceResponse`.
- [ ] Base64url encoding for VP token transport.
- [ ] Unit tests with known test vectors (ISO 18013-5 Annex D reference data).
- [ ] Error cases: missing namespace, unsupported COSE algorithm, invalid credential structure.