Implement issuer ownership challenge lifecycle

## Objective

Implement the common issuer ownership challenge lifecycle used by concrete proof mechanisms.

## Scope

This issue provides the shared challenge machinery: challenge creation, nonce generation, expiry, replay protection, challenge state storage, and verification result handling. Concrete proof methods such as reverse-domain proof or DID proof should plug into this foundation.

## Deliverables

- [ ] Add challenge creation endpoint/service for issuer ownership claims.
- [ ] Generate high-entropy nonces with expiry and single-use semantics.
- [ ] Persist challenge state with issuer identifier, proof method, expiry, status, and audit metadata.
- [ ] Reject expired, reused, mismatched, or malformed challenge completions.
- [ ] Add rate limiting or abuse controls appropriate for public challenge creation.
- [ ] Add tests for replay, expiry, wrong issuer, wrong proof method, and duplicate completion.

## Acceptance Criteria

- [ ] Challenge state cannot be replayed after successful completion.
- [ ] Failed or expired challenges do not authorize credential registration.
- [ ] Verification errors are actionable but do not reveal sensitive internal details.
- [ ] The implementation can support multiple proof methods without duplicating lifecycle code.