feat(enrollment)!: add human-entered confirmation codes

[Sequela02]

Summary

Adds a closed, configuration-owned proof format for contact enrollment:

• keeps OPAQUE_TOKEN for application-owned verification links;
• adds uniform eight-digit DECIMAL_CODE proofs for deliberate manual entry;
• protects the small code space with a dedicated, authority-bound HMAC-SHA-256 key;
• keeps one enrollment lifecycle, store contract, delivery port, and receipt/recovery path.

The configured format governs both generation and verification. There is no cross-format migration fallback or proof-strategy SPI.

Breaking migration

This prepares Vigil 8.0.0 because the compatibility-only constructors were removed:

• direct EnrollmentProperties callers must supply proofFormat and codeHmacKey;
• direct EnrollmentDelivery callers must supply proofFormat.

Changing proof format or the decimal-code key invalidates pending proofs. Resend remains bounded by the existing cooldown, attempt, resend, and total-lifetime policy; duplicate start does not reset the lifecycle.

Security and operations

Decimal codes are exactly eight ASCII digits, use approved secure randomness, have a maximum 15-minute TTL, and allow at most five lifecycle-wide attempts. Attempts remain cumulative across resend. The HMAC binds canonical email, context ID/version, trusted audience, purpose, format, and proof, and the dedicated key is excluded from state and string rendering.

The PostgreSQL contract fixture covers exact expiry, resend rotation, cumulative and concurrent attempt exhaustion, concurrent verification, and resend-versus-verify serialization. Hosts remain responsible for a durable atomic production EnrollmentStore, delivery infrastructure, and abuse controls.

Verification

• gradlew.bat clean check --no-daemon
• gradlew.bat qualityCheck build publishToMavenLocal --no-daemon --no-configuration-cache
• PostgreSQL Testcontainers: 6 tests, 0 skipped, 0 failures, 0 errors
• local Markdown links and git diff --check
• generated JARs, POM, Gradle module metadata, and Maven-local coordinates verified as 8.0.0

Closes #36