Add optional DID-based issuer proof validation

## Objective

Add optional DID-based issuer proof of control if the ADR accepts DID onboarding for production or a follow-up profile.

## Scope

This issue implements DID ownership proof as a separate proof mechanism so it can be enabled only when deployments are ready to operate DID resolution safely.

## Deliverables

- [ ] Define supported DID methods and resolver configuration.
- [ ] Verify that the challenge nonce is signed by a key authorized in the resolved DID document.
- [ ] Handle DID resolution timeouts, resolver failures, stale documents, and unsupported methods.
- [ ] Add caching rules for DID documents, including invalidation and maximum staleness.
- [ ] Add tests with fake resolvers for valid proof, wrong key, unsupported method, stale document, and replay attempts.
- [ ] Document deployment risks and configuration.

## Acceptance Criteria

- [ ] DID proof is disabled unless explicitly configured.
- [ ] DID proof authorizes only the issuer identifier bound by the challenge.
- [ ] Resolver failures fail closed and do not block non-DID onboarding modes.

## Dependencies

- Depends on the ADR/API contract issue.
- Depends on the challenge lifecycle issue.

## Related Issues

- Parent: #187