The identity spec omits the witness tier a server actually returns

`docs/specs/server-identity.md` states:

> `tier` -- `"attestor"` or `"repository"`, lowercase, always present.

A server running in witness mode returns a third value:

```json
{"v":1,"payload":{"tier":"witness","mode":"witness","now":1785872708},
"statement":{"kind":"unsigned"}}
```

`IdentityResponse::Witness` in `rs/cyphr-server/src/routes.rs` is real and behaving correctly. The specification's enumeration is the stale part.

This is not cosmetic. `GET /server` is the discovery endpoint a client uses to decide what it is talking to before it trusts anything, and the specification presents that enumeration as exhaustive. A client written against it mishandles every witness it meets — and the failure lands at the moment of first contact, which is exactly where the identity document's own trust-on-first-use story says a client must be able to decide correctly.

The fix is the enumeration, plus whatever the tier implies for the fields a client should expect: a witness currently carries no `pub` and no `pg`, which the document also does not describe.

Read docs/specs/server-identity.md alongside the IdentityResponse::Witness definition in rs/cyphr-server/src/routes.rs, starting with the documented tier enumeration and the GET /server response shape. Update the specification to include the witness tier and describe the absence of pub and pg for witness responses; done means the document matches the shown server behavior.

Written by the indexing model from the issue text.