Add identity trust administration surfaces

docs/DEVICE_KEY_TRUST_CONCEPT.md

@@ -51,6 +51,13 @@ The SQL-backed module now provides:
   expiry, and maximum-age checks;
 - migrations, uninstall guards, permissions, APIs, capability contracts, and
   manifest-driven user/admin documentation.
+- bounded user and security-officer projections for public device keys,
+  assurance provenance, subject epoch history, and immutable key-access
+  decisions;
+- user key revocation and security-officer epoch rotation surfaces with stale
+  revision rejection and explicit non-retroactivity consequences;
+- optional Access-backed account selection without making Access a hard module
+  dependency.
 
 Only public keys are accepted. JWK private parameters are rejected by the Core
 contract. Key-access decisions state explicitly that no cryptographic material
@@ -81,5 +88,8 @@ and quorum recovery remain with `govoplan-encryption` and its selected provider.
 - There is no private-key custody or browser/device key generator.
 - Attestation references are retained but no WebAuthn/OIDC attestation adapter
   is selected yet.
+- Device key generation and registration remains provider/browser driven; the
+  administration UI deliberately does not ask an operator to paste private or
+  manually generated key material.
 - The module decides trust eligibility; it does not perform encryption,
   decryption, signing, or rewrapping.