Enable identity verification

Mint the project identity secret so forms can require signed identify() calls and hold unverified submissions. Outward-facing (Tier B). The plaintext is returned EXACTLY ONCE and is never retrievable again. Minting into an occupied slot is refused: verification that was already on answers minted: false with no secret, so enabling twice can never read an existing secret back. Scope: workspace:manage; the key acts as the human who minted it (403 once they are no longer an owner or admin).