[Degentle12]

Summary

Implements self-sovereign identity (DID) integration for AetherMint. Learners can now create and manage a decentralized identifier bound to their Stellar wallet, with resolvable DID documents, verifiable Ed25519 signatures, and key rotation that does not invalidate previously issued credentials.

Acceptance criteria

• Learners can create and manage a DID bound to their wallet — new did_registry contract module (create_did, add_verification_method, deactivate_did, …) exposed on AetherMintContract, plus POST /api/did and the management endpoints.
• DID documents are resolvable and contain verification keys — resolve_did on-chain and GET /api/did/{did} return the document with its verification methods (key id, type, public key, added/retired timestamps, revocation flag).
• Issued credentials reference the holder's DID — attach_credential/get_credentials on-chain and POST|GET /api/did/{did}/credentials anchor issued credential references to the holder's DID.
• Verification resolves the DID document and checks signatures — verify_did_key on-chain, and off-chain verifyKey + real Ed25519 signature verification (verifySignature) in the DID service via POST /api/did/{did}/verify and GET /api/did/{did}/verify-key/{keyId}.
• Key rotation supported without breaking existing credentials — rotating retires the previous key(s) but keeps them in the document (and on the identity), so credentials signed under an older key still verify; only explicit revocation or DID deactivation stops a key.

Changes

• contracts/src/did_registry.rs (new) — DID registry with DID documents, verification methods, key rotation/revocation, deactivation, credential references, and on-chain lifecycle events (did_op topic) for off-chain indexers.
• contracts/src/lib.rs — registers the module and exposes the DID entry points on AetherMintContract.
• contracts/src/did_registry_test.rs (new) — 12 unit tests covering create/resolve, wallet binding, rotation (old keys stay valid), revocation, deactivation, and credential references.
• backend/src/models/Identity.ts (new) — Mongoose model for DIDs with verification methods and credential references.
• backend/src/services/did/ (new) — DidService with create/resolve/rotate/revoke/deactivate, key checks, Ed25519 signature verification (hex or base64 raw public keys, Node crypto), and an optional on-chain sync hook.
• backend/src/routes/did.ts (new) — /api/did endpoints (also mounted under /api/v1/did) with OpenAPI annotations; mutations require a bearer token, resolution/verification are public (DIDs are meant to be publicly resolvable).
• backend/src/__tests__/didService.test.ts (new) — 11 unit tests with real Ed25519 keypairs.
• backend/src/index.ts — mounts the DID routes.

CI notes

While working on this I found main's contract CI was already red, which this PR fixes where cheap and safe:

• cargo fmt --check failed on four spec/schema files (they merged that way in the spec-testing work) — the crate is now fmt-clean.
• contracts/src/credentials.rs did not compile (missing Symbol import left over from the Soroban SDK 20→26 migration) — fixed.
• lib.rs declared test modules for contracts that are commented out (analyticsStorage, consciousness, courseMetadata, event_logger, progress, syncCoordination, time_lock_credential, vrf_system); those dead test declarations are now disabled to match the build.

Remaining known issue (pre-existing, not touched here to keep this PR focused): the rest of the contract test suite still does not compile against soroban-sdk 26 (dna_storage_test, dynamic_nft_test, credentials_test, tokenomics_events_test, user_profile_test, and the spec/schema tests use pre-migration APIs). It is a follow-up item — the new DID tests are SDK-26 compatible and pass.

Verification

• Contracts: cargo fmt --check ✅, cargo clippy -- -D warnings ✅, cargo build --release ✅, DID contract tests 12/12 ✅
• Backend: tsc build ✅, eslint clean on new files ✅, DID service tests 11/11 ✅, OpenAPI spec generation + swagger-parser validation ✅ (360 documented paths)

Closes #397

[Degentle12]

Closing this PR — it targets issue #397, which is assigned to another contributor. The actual issue assigned to Degentle12 is #391 (unified payments). Reopening/repointing to a new PR for #391.