[Enhancement]: DID / verifiable credential operator identity adapter

[rosspeili]

Area (optional)

core framework

Problem or use case

#55 ships manual, mock, OIDC, and Auth0 adapters. Regulated buyers increasingly ask for decentralized identifiers and verifiable credentials without a central AURA identity service.

Proposed behavior

• New adapter did implementing OperatorIdentityAdapter
• Accept VC/JWT or DID document resolution (configurable resolver URL)
• Map to ids.operator with method: did, subject, verified: true
• Emit identity.bound with claim_keys only (no raw VC in spine by default)
• Document trust model and redaction in integrations/identity/README.md

Alternatives considered (optional)

Embed DID logic in OIDC adapter — rejected; DID verification path differs from JWKS OIDC.