[vmarkop]

Add wallet-provider lifecycle support for Wallet Instance Attestations (WIAs) and Key Attestations (KAs), based on WE BUILD CS-04.

Each generated attestation receives a distinct, persisted status reference. Revoking an account invalidates all its WIA/KA entries and prevents further attestation issuance.

Changes

• Add authenticated WIA generation with client identity, authorization-server audience, and proof-of-possession key binding.
• Extend KA claims with key-storage and user-authentication assurance, certification URL, and revocation status.
• Publish signed Token Status List JWTs through a public endpoint, using the provider signing identity, ZLIB compression, and a 60-second lifetime.
• Persist random, non-reused status indices with a 32-day (1+31) maintenance period. Unallocated, revoked, and maintenance-expired entries report invalid.
• Add authenticated self-revocation.
• Canonicalize certificate chains for JOSE x5c headers.

Deployment and verification

Migration is required to get the new status list database tables - run yarn typeorm migration:run before starting the updated backend to create the three status tables.

Manually verify issuance and revocation using disposable accounts:

1. Generate WIA and KA tokens, fetch their status-list URIs without authentication, and verify their signatures and indexed status bits.
2. Revoke one account and confirm all its entries become invalid, another account remains valid, and fresh issuance returns 403.
3. Restart the backend and confirm status persists.

Limitations

• Operator revocation is not implemented, as there is no concept of an operator role in wwWallet that manages other accounts.
• Revoking an account revokes all WIA/KA attestations associated with it across all devices and prevents that account from obtaining new attestations. Individual devices cannot be revoked separately.
• WIA and KA tokens expire after 15 seconds. The frontend must obtain a fresh WIA before delayed token exchanges and refresh requests.