Server Hardening & Spec Compliance

### Description

Hardening the server for production readiness and tightening OID4VC spec compliance. This covers credential encryption at rest, configurable service backends (database, Redis, KMS), Docker packaging, client authentication methods, OID4VC configuration consolidation, scope-based credential request support, mdoc claims rendering, and cross-cutting reusability of crypto and trust-anchor building blocks.

### Spec References

- [OpenID4VCI 1.0 — Full Spec](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)
- [OpenID4VP 1.0 — Full Spec](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)
- [HAIP 1.0 — Full Spec](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html)

### Motivation

The current server uses in-memory adapters for all persistence (`MemoryCredentialRepo`, `MemoryTenantRepo`, `MemoryTaskQueue`, `MemoryEventPublisher`), has no credential encryption wired up, no Docker packaging, no configurable backend selection, fragmentary OID4VC config, and several spec-mandated features that are only partially implemented. This EPIC tracks the work needed to make the server production-viable and spec-compliant.

### Sub-issues & Dependency Graph

**Parallel track A — Infrastructure (can start immediately, no cross-dependencies):**
- #372 — Configurable service backends via Cargo features
- #371 — Wire credential encryption at rest via KMS cipher *(dependent on #372 for KMS feature selection)*
- #373 — Docker and Docker Compose configuration *(dependent on #372 for feature-gated builds)*

**Parallel track B — Protocol Compliance (can start immediately, no cross-dependencies):**
- #376 — Scope-based credential configuration selection
- #374 — Client authentication: support all `token_endpoint_auth_methods`
- #377 — mdoc claims rendering for presentation and display

**Sequential track C — Consolidation (depends on Track A/B):**
- #375 — Consolidate OID4VC config and unify root trustore loading *(prerequisite for #378)*
- #378 — Consolidate crypto signer, X.509 validation, and trust anchor loading *(depends on #375, supersedes #365)*