fix(idemix): never return a nil error when credential verification fails

[AkramBitar]

NewKeyManagerWithSchema funnelled both credential-verification failure modes through errors.WithMessagef(err, ...). When the BCCSP reports a bad credential as valid == false with a nil error, wrapping nil yields nil, so the constructor returned (nil, nil). Callers checking only err != nil then used a nil *KeyManager and panicked later, far from the real cause.

The branch is now split: an error is wrapped, !valid returns a fresh error. A verification failure is always reported as a non-nil error.

Tests: a BCCSP decorator forcing each outcome ((false, nil) — the bug, (false, err), (true, err)) across both curve configs, a happy-path pin, and an end-to-end case with a tampered credential rejected by the real BCCSP. The (false, nil) case fails before this change and passes after.

Docs: added "Credential Verification at Load Time" to docs/services/identity.md.

Fixes #2062

[github-actions]

📊 Token Validation Benchmark

Comparison of this PR against the base branch. 🟢 improvement · 🔴 regression · ➖ within ±1.0% noise.

Variant	Benchmark	Params	Workers	TPS (base → PR)	Δ TPS
csp	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	118 → 117	➖ -0.1%
csp	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	104 → 104	➖ -0.0%
ipa	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	70 → 70	➖ +0.1%
ipa	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	76 → 76	➖ +0.3%

[github-actions]

📊 Token Validation Benchmark

Comparison of this PR against the base branch. 🟢 improvement · 🔴 regression · ➖ within ±1.0% noise.

Variant	Benchmark	Params	Workers	TPS (base → PR)	Δ TPS
csp	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	117 → 117	➖ -0.1%
csp	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	104 → 104	➖ +0.3%
ipa	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	78 → 78	➖ +0.2%
ipa	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	68 → 68	➖ +0.6%