identity: pushed authorization requests (PAR, RFC 9126, +7 tests)

push_authorization_request lodges the authorization params under a
single-use request_uri; authorize_pushed redeems it into the normal consent
flow. Pushed requests reuse the pending store ({pushed, Rec} keyed by the
request_uri ref — distinct from consent req_ids, so no collision and no new
loop state). The pushed binding (client + redirect + PKCE) is still enforced
at exchange. New tests/par.sx. 217/217.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 210 / 210 tests passing**
+**Total: 217 / 217 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -23,6 +23,7 @@
 | ✅ | session-mgmt | 8 | 8 |
 | ✅ | exchange | 8 | 8 |
 | ✅ | introspect | 9 | 9 |
+| ✅ | par | 7 | 7 |
 
 
 Generated by `lib/identity/conformance.sh`.