feat(sigild): DB + atomic consume + revocation/audit MVP (CTX-0023)

[Xuepoo]

Summary

Implements CTX-0023 — Sigild server MVP: DB + atomic consume + revocation/audit per docs/research/media-credential/usage/credential-design.md §4.

• DB schema covers / credentials / credential_consumptions / audit_events (Postgres normative, SQLite WAL with rusqlite bundled, migrations/001_initial.sql, SCHEMA_SQL in db.rs)
• Atomic consume via UPDATE ... RETURNING inside BEGIN IMMEDIATE + Idempotency-Key (UNIQUE credential_id, idempotency_key), verify is read-only, revoke + audit trail
• Carrier integration via capglyph_core::{framing,ecc} — encode_credential_token / decode_credential_token (CBOR seal + Repetition8, soft-bit LLR path, KMS K_mac/K_embed HMAC split)
• HTTP axum: POST /v1/credentials (issue), /verify, /consume, GET /v1/credentials/{id}, POST /v1/credentials/{id}/revoke (header Idempotency-Key)
• Binary capglyphd (crates/capglyph-server/src/bin/capglyphd.rs)
• Docs crates/capglyph-server/README.md + docs/sigild-mvp.md

Tests

• cargo test -p capglyph-server --test concurrent_consume — 8 tests including concurrent no double-spend (10 threads max_uses=1 → 1 success, max_uses=3 → 3, idempotent replay, verify readonly, revoked/expired fail-closed, audit)
• cargo test --workspace / cargo clippy --workspace --all-targets -- -D warnings / cargo fmt / cargo check --lib --target wasm32-unknown-unknown --no-default-features all pass
• WASM clean: capglyph-server is a separate crate not in capglyph lib graph

How to test

cargo test -p capglyph-server
cargo run -p capglyph-server --bin capglyphd -- --db /tmp/capglyphd.db --listen 127.0.0.1:3000
curl -X POST http://127.0.0.1:3000/v1/credentials -H 'content-type: application/json' -d '{"cover_id":"...","scope":["download:asset:42"],"max_uses":1}'

Closes CTX-0023