Add trusted issuer registry validation for registration

## Objective

Add trusted issuer registry or federation validation as an optional registration gate.

## Scope

This issue adds a configurable registry check so production deployments can accept only issuers present in an approved trust source, such as a static allowlist, EUDI trusted issuer list, OpenID Federation metadata, EBSI, or a compatible internal registry.

## Deliverables

- [ ] Define a registry provider trait/configuration model.
- [ ] Implement at least one simple provider, such as static file or static config, for deterministic tests and local deployments.
- [ ] Define refresh, cache, failure, and stale-data behavior.
- [ ] Gate issuer registration by registry membership when configured.
- [ ] Add tests for allowed issuer, denied issuer, stale registry, refresh failure, and disabled registry mode.
- [ ] Document how registry validation composes with domain/DID/operator proof.

## Acceptance Criteria

- [ ] Registry validation is optional and fail-closed when enabled.
- [ ] Registration succeeds only when both proof and registry policy pass.
- [ ] Cache refresh failures are observable and do not leak registry credentials.

## Dependencies

- Depends on the ADR/API contract issue.
- Can be implemented after a first proof mechanism exists.

## Related Issues

- Parent: #187
- Related: #177