feat: add step-up self-custody export foundation

[Yerickmondra15]

Summary

• add a five-minute, 256-bit one-time export authorization stored only as a SHA-256 digest
• bind authorization claims to the learner, wallet, and authenticated session fingerprint
• add trusted KMS load/delete operations and prevent delivery until managed material is deleted
• define guarded self-custody authorization/export route contracts with no-store and attachment headers
• document eligibility, acknowledgement, failure handling, support policy, and production activation requirements
• test step-up, expiry, cross-user/cross-session rejection, replay, concurrency, KMS deletion failure, and secret leakage

Current draft scope

This is intentionally a draft foundation because #130, #135, and custody-policy approval are still open. The route factory is not mounted in the application until those dependencies provide:

• a durable refresh-session identifier
• transactional authorization/wallet persistence with compare-and-set claim semantics
• a production KMS read/delete adapter
• the approved KMS deletion-failure and custody recovery runbook

The in-memory KMS adapter and repository contract make the security behavior reviewable and testable without enabling an incomplete production path.

Security behavior

• ordinary JWT possession is insufficient; a fresh password step-up and explicit acknowledgement are required
• expired, replayed, cross-user, and cross-session attempts return a generic authorization failure
• secrets use the redacting SensitiveValue boundary and are excluded from audits and error serialization
• delivery uses application/octet-stream plus Cache-Control: no-store, Pragma: no-cache, Surrogate-Control: no-store, and nosniff
• KMS deletion failure prevents secret delivery

Validation

• pnpm build
• pnpm lint
• focused wallet/security suite: 22 passed
• complete unit suite: 546 passed, 3 skipped because no integration database was available

Closes #93