Define credential registration and rotation lifecycle

## Objective

Split issuer credential registration, update, and rotation into clear authorization-controlled workflows.

## Current State

`POST /api/v1/credentials` registers issuer public keys. There is an existing broad issue (#187) about issuer registration ownership. This sub-issue narrows the implementation path so registration and rotation can be worked in smaller PRs.

## Deliverables

- [ ] Define whether first-time registration is public, admin-only, or invitation/onboarding-token protected.
- [ ] Add a separate authenticated credential update/rotation workflow.
- [ ] Prevent accidental overwrite or issuer takeover.
- [ ] Add audit-friendly error cases for duplicate issuer, wrong issuer, malformed JWK, and unsupported key type.
- [ ] Document the chosen lifecycle in README/OpenAPI.

## Acceptance Criteria

- [ ] First registration and later rotation have distinct rules.
- [ ] Existing issuers cannot be taken over by posting a new JWK.
- [ ] Rotation is authenticated and issuer-bound.
- [ ] Tests cover duplicate registration and authorized/unauthorized rotation.

## Verification

- [ ] Handler/service tests
- [ ] OpenAPI updated
- [ ] Demo workflow updated or added