identity: unify api.sx facade over audit + membership (+9 tests)

The identity coordinator now owns an audit ledger and a membership registry
alongside its token table (started with the ledger) and session registry.
login/logout are audited; new ops history/enroll/member_status/member_project
surface the audit and membership axes through the one `identity` door.
Identity proves who and reports membership; acl still decides permission.
Existing api behaviour unchanged. New tests/facade.sx. 177/177.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 168,
-  "total": 168,
+  "total_pass": 177,
+  "total": 177,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -16,6 +16,7 @@
     {"name":"expiry","pass":8,"total":8,"status":"ok"},
     {"name":"clients","pass":11,"total":11,"status":"ok"},
     {"name":"grants","pass":9,"total":9,"status":"ok"},
-    {"name":"device","pass":10,"total":10,"status":"ok"}
+    {"name":"device","pass":10,"total":10,"status":"ok"},
+    {"name":"facade","pass":9,"total":9,"status":"ok"}
   ]
 }