Align reference implementation with Draft 04

[litzki-systems]

Summary

Align the reference implementation with the accepted draft-litzki-sovp-04 specification.

Changes

• Add optional host binding to verify_identity() and enforce it in validate_domain().
• Require freshness.created and freshness.expiresAt for schema v2.0 documents.
• Validate timestamp format, expiry ordering, clock skew, and expiry.
• Generate a default one-hour expiresAt for v2.0 identity documents.
• Enforce the 600-second issuance window when timestamp checking is enabled.
• Restrict the legacy endpoint fallback to HTTP 404 from the well-known endpoint.
• Add regression tests for host binding, v2.0 freshness, expiry, and retrieval behavior.
• Keep the existing fixed cryptographic test vectors intact.

Instance binding remains outside this change set, consistent with the implementation-status note in Draft 04.