OID4VP Server Handlers (Start, Consent, Events)

Part of Epic #13

### Description

Create HTTP handlers in `src/server/handlers/presentation/` that expose the OID4VP wallet functionality through the server API. These mirror the existing issuance handlers. They must implement the presentation operations defined in `openapi.yaml`.

### Endpoints

| Endpoint | Method | Handler | Description |
|----------|--------|---------|-------------|
| `POST /presentation/start` | POST | `start.rs` | Accepts an `authorization_url` (OID4VP deep link) or raw request, initiates the flow and returns `StartPresentationResponse` |
| `POST /presentation/{session_id}/consent` | POST | `consent.rs` | Accepts user's consent decision with selected credentials via `PresentationConsentRequest`. Triggers VP token construction and response sending |
| `GET /presentation/{session_id}/events` | GET | `events.rs` | Optional SSE stream for real-time flow progress (if we want to align with issuance UX) |

### Request/Response Contracts

**Start Request (`StartPresentationRequest`):**
```json
{
"request": "openid4vp://?request_uri=...&client_id=...",
"origin": "https://wallet.example.com"
}
```

**Consent Request (`PresentationConsentRequest`):**
```json
{
"accepted": true,
"selected_credentials": [
{ "query_id": "pid_request", "credential_id": "c3d4e5f6-7890-abcd-ef12-3456789abcde" }
],
"transaction_data_acknowledged": false
}
```

### Spec References

- `openapi.yaml` endpoints `POST /presentation/start` and `POST /presentation/{session_id}/consent`
- [OpenID4VP §5 — Authorization Request](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-5)
- [OpenID4VP §8 — Authorization Response](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-8)

### Acceptance Criteria

- [ ] `start.rs`, `consent.rs`, and `events.rs` handlers created.
- [ ] Handlers registered in the router alongside issuance routes.
- [ ] `start` handler parses OID4VP URL, delegates to `PresentationEngine::start()`, returns `StartPresentationResponse`.
- [ ] `consent` handler loads session, delegates to `PresentationEngine::consent()` if accepted, returns `PresentationConsentResponse` with outcome.
- [ ] Error responses use standard `ErrorResponse` format (e.g., `invalid_request`, `invalid_dcql_query`, `no_matching_credentials`).
- [ ] Authentication/authorization: `tenant_id` verified from JWT Bearer token (same pattern as issuance).
- [ ] Integration tests with mocked engine dependencies.