Complete the normative v1 directory surface

[jt55401]

What changed

• expose exactly the seven canonical root operations while retaining /api compatibility routes
• enforce the exact sig1 RFC 9421 component profile on canonical writes and exercise its rejection cases live
• give new keys opaque public ids, preserve legacy ObjectId aliases, and backfill ids in migrate:v1
• require an explicit HTTPS directory base URL in production
• align OpenAPI paths, schemas, media types, and compatibility authentication with runtime
• expand the live v1 conformance runner across every canonical operation
• refresh the canonicalization dependency

Verification

• npm test (90 passed)
• npm run openapi:lint
• npm run conformance (12 compatibility scenarios plus the v1 live suite)
• in-memory public-id migration smoke check

Fixes #3