Write ADR and API contract for issuer registration ownership

## Objective

Write the issuer registration ownership ADR and define the API/config contract before implementation work begins.

## Scope

This issue decides the first production-supported ownership model for issuer registration and turns it into an implementable contract for handlers, services, storage, OpenAPI, and operator configuration.

## Deliverables

- [ ] Add `docs/adr/0003-issuer-registration-ownership.md` or the next available ADR number.
- [ ] Decide the initial supported onboarding modes:
- server-assigned issuer identifier,
- reverse-domain issuer identifier with domain control proof,
- optional/admin-controlled registration path if needed for production rollout.
- [ ] Explicitly defer or accept DID proof, trusted issuer registry checks, mTLS, and federation integration.
- [ ] Define endpoint contracts for challenge creation, challenge completion, credential registration, and later credential/key updates.
- [ ] Define request/response/error semantics without leaking sensitive material.
- [ ] Define migration/deprecation behavior for the existing open `POST /api/v1/credentials` endpoint.

## Acceptance Criteria

- [ ] The ADR states the selected strategy and why alternatives are deferred or rejected.
- [ ] API contracts are clear enough for endpoint and storage implementation tickets to proceed independently.
- [ ] Backward compatibility or breaking-change behavior is explicit.
- [ ] The trust model document and OpenAPI update scope are identified.