Managed DID status stays PUBLISHED after the DID is deactivated

## Environment

identus-cloud-agent 2.2.0 (docker), neoprism 0.14.2 as the node, multi-tenant setup with Keycloak.

## Steps to reproduce

1. `POST /did-registrar/dids` to create a managed DID.
2. `POST /did-registrar/dids/{didRef}/publications`, wait until `GET /did-registrar/dids/{didRef}` reports `PUBLISHED`.
3. `POST /did-registrar/dids/{didRef}/deactivations`, the operation is accepted and applied: `GET /dids/{didRef}` answers 410 and the resolution metadata carries `"deactivated": true`.
4. `GET /did-registrar/dids/{didRef}` again, and `GET /did-registrar/dids`.

## Expected

The managed DID reports a state that shows the DID is deactivated.

## Actual

The status stays `PUBLISHED` forever, both for the single DID and in the list. The OpenAPI description of the status field says it tracks the publication state only and "Does not represent DID a lifecyle (e.g. `deactivated`, `recovered`, `updated`)", so this may be by design, but a client that lists the wallet's DIDs cannot show the real state without resolving every DID one by one.

On the same flow: a second `POST /did-registrar/dids/{didRef}/deactivations` on the already-deactivated DID answers 500 "An unexpected error occurred when servicing the request" instead of a clear 4xx.

## Impact

In identity-portal the DID list shows deactivated DIDs as published and still offers update / deactivate on them, and a second deactivate surfaces the 500. Context: hyperledger-identus/identity-portal#99, hyperledger-identus/identity-portal#102.

## Suggestion

Either a `DEACTIVATED` status value, or a separate lifecycle field on the managed DID, whichever fits the model.