feat: add SHA-256 contentAddress to identity document

[litzki-systems]

Summary

• Computes SHA-256 over the JCS-canonicalized payload bytes (same bytes used for Ed25519 signature) in generate_identity_document()
• Appends contentAddress: {alg: "sha256", digest: "<hex>"} to the returned document
• Adds contentAddress to _OUT_OF_SCOPE_KEYS so verify_identity() strips it before canonicalization — keeps verification deterministic when a full document is passed

Output example

"contentAddress": {
  "alg": "sha256",
  "digest": "db4f1d7d23c181f5b64ecb4e3cd0ce0b7803806417caea386279055fe15cc25d"
}

No new canonicalization step — reuses canonical_data already computed for signing.

Test plan

• generate_identity_document() returns contentAddress with alg and digest
• digest matches hashlib.sha256(jcs.canonicalize(non_proof)).hexdigest()
• verify_identity(doc, sig, pub) still returns True when full document (including contentAddress) is passed

---

Generated by Claude Code