identity: service facade api.sx — login/verify/revoke/logout (10 tests, Phase 1 complete)

identity:start() spawns one coordinator owning the token table + session
registry and exposes the whole-domain ops. The coordinator is the owner
sessions notify on idle timeout, so an expired session deregisters itself
— timeout-driven, never swept. verify/2 answers identity only ({active,
Subject, Client, Scope}); permission is delegated to acl. 39/39.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,12 +1,13 @@
 # identity-on-sx Scoreboard
 
-**Total: 29 / 29 tests passing**
+**Total: 39 / 39 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
 | ✅ | session | 11 | 11 |
 | ✅ | token | 9 | 9 |
 | ✅ | registry | 9 | 9 |
+| ✅ | api | 10 | 10 |
 
 
 Generated by `lib/identity/conformance.sh`.