Document and test issuer registration ownership flows end to end

## Objective

Close the issuer registration ownership work with documentation, OpenAPI updates, and end-to-end regression coverage.

## Scope

This issue ties together the implementation slices so the final behavior is understandable, testable, and reflected in public project documentation.

## Deliverables

- [ ] Update OpenAPI for challenge, registration, rotation, recovery, and error responses.
- [ ] Update README and operator docs with issuer onboarding examples.
- [ ] Update the trust model document with accepted proof modes and registry behavior.
- [ ] Add end-to-end tests for first registration, failed arbitrary claim, successful proof, key rotation, and recovery/revocation where implemented.
- [ ] Add negative tests for replay, duplicate issuer, wrong key, wrong domain/DID, and unauthorized rotation.
- [ ] Confirm logs and error responses do not leak keys, tokens, credentials, or proof material.

## Acceptance Criteria

- [ ] A maintainer can run a documented issuer onboarding flow locally or in a test environment.
- [ ] OpenAPI matches implemented request/response behavior.
- [ ] Security-sensitive negative cases are covered by automated tests.
- [ ] #187 can be closed once this and the implementation sub-issues are complete.

## Dependencies

- Depends on the proof, registration lifecycle, key history, and recovery implementation issues.

## Related Issues

- Parent: #187
- Related: #147, #177, #319