feat!: migrate the AAuth SDK and samples to v10

[dasiths]

Summary

This PR vendored immutable AAuth v09 and v10 specification snapshots and migrated the SDK, R3 implementation, Events implementation, samples, tests, and documentation to the v10 specification family.

The migration made an intentional breaking alpha cutover. It removed obsolete APIs and wire formats instead of retaining compatibility aliases or dual-format parsers.

Major Changes

• Replaced legacy error responses with shared AAuth problem details and migrated error_description usage to detail
• Implemented v10 signature carriers, explicit Ed25519 and ES256 keys, typed JWT verification, replay controls, and admitted metadata and JWKS transport
• Hardened token issuance bounds, pending-request ownership, authenticated consent and CSRF handling, federation and delegation context, resource challenge verification, account binding, and issuer-qualified revocation
• Added R3 operation vocabularies, proposal enforcement, conditional grants, retained content, and durable audit behavior
• Added AAuth Events flows with transactional quota, outbox, tickets, receipts, pagination, persistence, and retry handling
• Updated public APIs and dependency injection to require explicit credentials, trust, transport, and persistence responsibilities
• Migrated the runnable samples, GuidedTour, SampleApp, browser scenarios, operational targets, documentation, and source-checked snippets
• Replaced real waits in polling tests with controlled clocks and delay hooks without reducing test coverage

Breaking Changes

Consumers must update removed APIs, error properties, signature encodings, algorithm identifiers, and stricter dependency-injection configuration. Persisted pre-v10 demo keys are not accepted through a compatibility fallback; versioned v10 demo state isolates the new format.

Validation

• Complete Release suite: 2,913 passed, zero failed or skipped in 48 seconds (1,469 core, 1,079 conformance, 290 R3, and 75 Events)
• Release and make build: zero warnings and zero errors
• Documentation, source-semantic, and link checks: 105 passed
• Public API inventory: 201 changed source files, 810 additions or replacements, 162 removals or replacements, zero unmapped
• Full stub Playwright gate with fresh services: 71 passed and one Keycloak-only skip, retries set to 0
• Full local live-Keycloak Playwright gate: 72 passed, zero skipped, retries set to 0

The live-Keycloak gate was run locally and is not part of normal CI. The browser evidence does not establish external AAuth interoperability or production identity, transport, storage, or platform-attestation guarantees.

Review Guidance

1. Review migration scope, compatibility policy, and limitations in the v10 research, implementation plan, and conformance ledger
2. Review problem details, cryptography, signature carriers, verification, replay, and discovery and egress changes under src/AAuth
3. Review issuance, pending ownership, consent, federation, delegation, account binding, and revocation paths
4. Review R3 and Events models, endpoint enforcement, audit, transactionality, persistence, and retry behavior under src/AAuth.R3, src/AAuth.Events, and samples/EventSupport
5. Review public API, dependency injection, solution, Makefile, workflow, and package integration
6. Review adversarial tests first, followed by primary application workflows and documentation inventories

Related Issues

None