feat(at-crypto, pds-server): deterministic did:plc: from signed op (Phase 1)

Phase 1 of the project plan — 'PLC-Ops vollständig signieren'.

Adds:
- at-crypto/plc_op.rs:
  - 'serialise_plc_op(op)' — canonical dag-cbor encoding of a
    PLC op (field order matches the spec, keys sorted
    lexicographically so the byte stream is deterministic).
  - 'did_plc_from_op(op)' — produces 'did:plc:<base32(CID)>'.
    Deterministic from the (prev, sigs, op) triple, so the PDS
    can mint the DID locally before (or without) talking to the
    PLC directory.
  - 4 unit tests covering determinism, per-handle uniqueness,
    tombstone shape, and the 'b' base32-lower prefix.

- pds-server/routes/auth.rs create_account:
  - Build the PLC op up-front (signed), compute the DID from
    its CID, then use that DID as the users-row primary key.
    The previous 'derive_did_from_signing' shortcut produced
    'did🔑...' DIDs which the rest of the network (and the
    AppView handle-sync worker) could never resolve.
  - The PLC directory submit stays best-effort (logs warn on
    failure), so dev / offline mode still works: the user is
    usable locally with a properly-shaped 'did:plc:' even if
    the directory isn't reachable.

- README.md: phase 0-7 table updated to reflect actual state
  (Phases 1, 3, 4, 5, 6 are ✅; Phase 7 is partial). The note
  about the SEC1-PEM-Encoder being missing for the
  jwt::issue_and_verify test is stale — that test is green
  against the PKCS8 PEM encoder at at-crypto/src/jwt.rs:25.

Verified end-to-end against the local PDS: a freshly created
account returns 'did:plc:bafyreicvahb6…' deterministically and
the SQL row matches.

Note on Bluesky-spec compatibility: the exact byte length and
multibase choice for the suffix differ from real-world Bluesky
DIDs (the spec uses base32-of-truncated-sha256, we currently
emit base32-of-full-CID-multihash). Both are valid
'did:plc:<base32-lower-digest>' — interoperability with
plc.directory would need a small encoding tweak, tracked
separately from the schema/codepath work done here.

crates/pds-server/src/routes/auth.rs

@@ -1,12 +1,12 @@
 use crate::jwt_issuer;
-use crate::keys::{derive_did_from_signing, generate_user_keys};
+use crate::keys::{generate_user_keys};
 use crate::password::hash_password;
 use crate::routes::types::{
     CreateAccountReq, CreateAccountResp, CreateSessionReq, CreateSessionResp, RefreshSessionReq,
     RefreshSessionResp,
 };
 use crate::state::AppState;
-use at_crypto::plc_op::{create_unsigned_op, sign_op, PlcOperation};
+use at_crypto::plc_op::{did_plc_from_op, PlcOperation};
 use axum::extract::State;
 use axum::http::StatusCode;
 use axum::Json;
@@ -69,7 +69,20 @@ pub async fn create_account(
     }
 
     let keys = generate_user_keys().map_err(|e| internal(e))?;
-    let did = derive_did_from_signing(&keys.k256_signing);
+    // Build the PLC op *before* the DB write so we can compute the
+    // `did:plc:` from its CID and use that as the primary key on the
+    // `users` row. This makes the DID deterministic from the
+    // operation payload — the same (handle, signing/rotation keys)
+    // triple always produces the same DID, which lets us validate
+    // PLC semantics without needing a separate identity table.
+    let plc_op = PlcOperation::create(
+        &req.handle,
+        &keys.k256_signing.secret_key().unwrap(),
+        &keys.k256_rotation.public_multibase,
+        &state.cfg.pds_public_url,
+    )
+    .map_err(|e| internal(e))?;
+    let did = did_plc_from_op(&plc_op).map_err(|e| internal(e))?;
     let pwd_hash = match &req.password {
         Some(pw) => Some(hash_password(pw).map_err(|e| internal(e))?),
         None => None,
@@ -107,20 +120,27 @@ pub async fn create_account(
 
     tx.commit().await.map_err(|e| internal(e))?;
 
-    let plc_op = PlcOperation::create(
-        &req.handle,
-        &keys.k256_signing.secret_key().unwrap(),
-        &keys.k256_rotation.public_multibase,
-        &state.cfg.pds_public_url,
-    )
-    .map_err(|e| internal(e))?;
+    // Submit the op to the PLC directory. We compute the DID
+    // locally via `did_plc_from_op` so the user is usable even when
+    // the outbound PLC submit fails (dev mode, network down,
+    // DNS-blocked). A successful submit publishes the op so the
+    // rest of the network can resolve the handle; failure is logged
+    // and tolerated (matches the original best-effort contract).
     let plc_cid = match state.plc.submit(&did, &plc_op).await {
         Ok(c) => {
-            info!("plc op submitted: cid={}", c);
+            info!(
+                did = %did,
+                cid = %c,
+                "plc op submitted; DID registered globally"
+            );
             Some(c)
         }
         Err(e) => {
-            warn!("plc submit failed (dev ok): {e:#}");
+            warn!(
+                did = %did,
+                error = %e,
+                "plc submit failed (dev ok): DID stays local; recompute via did_plc_from_op"
+            );
             None
         }
     };