fix(indexer): harden primary-claim key resolution

[randomblocker]

Closes #81.

What changed

• Add one validated primary-claim key-resolution boundary with a strict built-in Demos resolver.
• Accept mixed-case leading did scheme spelling on read and return the canonical lowercase claim.
• Reject uppercase key material, demos:0x…, bare/address aliases, unknown schemes, and unsupported algorithms by default.
• Route current listing, revocation, registration, BundleBinding, referenced-artifact, DACS-5 graph, rating, and VerifyResult signature checks through that resolver.
• Keep substrate owner/address parsing separate and confine historical DID/bare/0x equivalence to the pinned legacy SDK bundle-result path.
• Add an injectable resolver contract for deployments that later support another registered ClaimReference scheme.

Why

Several indexer paths extracted any trailing 64 hex characters and treated them as an Ed25519 key. A cryptographically valid artifact using an unregistered claim such as domain:<64hex> could therefore be accepted as if the Directory supported that ClaimReference scheme. The new boundary fails closed unless a scheme-specific resolver is explicitly supplied.

Impact

Current-profile verification now has one consistent identity/key policy. Existing canonical Demos artifacts remain valid, mixed-case did input canonicalizes on read, and unsupported claim schemes are no longer silently aliased.

Validation

• npm run typecheck
• npm test — 184/184 passing
• npm run check:deploy-config
• npm run build
• isolated Playwright rerun for the only locally timed-out landing-page case — passing