feat: add did:dht support to verifiable credentials

- Add dht_did field to IdentityRecord (optional, serde-compatible)
- Add prefer_dht_did param to identity.issue-credential RPC
- When true and dht_did is set, uses did:dht as VC issuer
- Credential system already format-agnostic for any DID type

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/credentials.rs

@@ -28,9 +28,23 @@ impl RpcHandler {
             .unwrap_or(serde_json::json!({}));
         let expires_at = params.get("expires_at").and_then(|v| v.as_str());
 
+        let prefer_dht = params
+            .get("prefer_dht_did")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false);
+
         let manager = IdentityManager::new(&self.config.data_dir).await?;
         let issuer_record = manager.get(issuer_id).await?;
-        let issuer_did = issuer_record.did.clone();
+        // Use did:dht if available and preferred, otherwise did:key
+        let issuer_did = if prefer_dht {
+            issuer_record
+                .dht_did
+                .as_deref()
+                .unwrap_or(&issuer_record.did)
+                .to_string()
+        } else {
+            issuer_record.did.clone()
+        };
 
         // Capture identity_id for the signing closure
         let data_dir = self.config.data_dir.clone();

core/archipelago/src/identity_manager.rs

@@ -40,6 +40,9 @@ pub struct IdentityRecord {
     pub purpose: IdentityPurpose,
     pub pubkey_hex: String,
     pub did: String,
+    /// did:dht identifier (published to Mainline DHT for discoverability)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dht_did: Option<String>,
     pub created_at: String,
     /// Nostr secp256k1 public key in hex format
     pub nostr_pubkey: Option<String>,