identity: unify api.sx facade over audit + membership (+9 tests)

The identity coordinator now owns an audit ledger and a membership registry
alongside its token table (started with the ledger) and session registry.
login/logout are audited; new ops history/enroll/member_status/member_project
surface the audit and membership axes through the one `identity` door.
Identity proves who and reports membership; acl still decides permission.
Existing api behaviour unchanged. New tests/facade.sx. 177/177.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **168/168** (4 phases + 6 ext incl device grant)
+`bash lib/identity/conformance.sh` → **177/177** (4 phases + 7 ext incl unified facade)
 
 ## Ground rules
 
@@ -85,9 +85,16 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] client-credentials grant (RFC 6749 §4.4) + device grant (RFC 8628)
 - [ ] acl-on-sx delegation: wire `verify`/membership projection → an acl decision, integration test
 - [ ] OAuth `state` (CSRF) + OIDC `nonce` threaded through authorize→exchange
-- [ ] unify `api.sx` over oauth + membership + audit (one facade, audited login/consent)
+- [x] unify `api.sx` over membership + audit (one facade, audited login/logout)
 
 ## Progress log
+- 2026-06-07 — unified facade (ext): `api.sx` coordinator now owns an audit
+  ledger + a membership registry alongside its token table (started with the
+  ledger) and session registry. login/logout are audited; new ops
+  `history`/`enroll`/`member_status`/`member_project` expose the audit +
+  membership axes through the one `identity` door. identity proves who +
+  reports membership; acl still decides permission. Existing api behaviour
+  unchanged (10/10). New tests/facade.sx (9). 168→177.
 - 2026-06-07 — `device.sx` (ext, RFC 8628): device authorization grant for
   input-constrained devices. authorize → {device_code, user_code}; the human
   approve/deny out-of-band by user_code; the device polls by device_code