chore(oss): audit the server package and resync the SDK mirrors

Split the 657-line operation service into eor, submit, and verify
modules, add the AGENT_REVOKED and KEY_RETIRED codes the Backend already
emits, and condense every multi-line comment. Mirror Node, Python, and
Go at 2.1.0 with the deep-health 503, non-idempotent retry, rotation
grace, and path-encoding fixes. Document which routes and response
fields the self-hosted server does not provide.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

packages/server/src/routes/jwks.ts

@@ -1,13 +1,4 @@
-/**
- * JWKS route — public key discovery endpoint.
- *
- * Returns the JSON Web Key Set containing the Elydora server's public
- * keys used for signing attestation receipts (EAR) and epoch roots (EER).
- * External verifiers can use these keys to independently validate
- * signatures without contacting the Elydora API.
- *
- * This endpoint requires NO authentication (per OpenAPI spec and RFC 7517).
- */
+/** JWKS route: public key discovery endpoint. */
 
 import { Hono } from 'hono';
 import type { Env, AppVariables } from '../types.js';
@@ -17,7 +8,7 @@ import { deriveEd25519PublicKey } from '../utils/crypto.js';
 const jwks = new Hono<{ Bindings: Env; Variables: AppVariables }>();
 
 // ---------------------------------------------------------------------------
-// GET /.well-known/elydora/jwks.json — Retrieve the platform JWKS
+// GET /.well-known/elydora/jwks.json: Retrieve the platform JWKS
 // ---------------------------------------------------------------------------
 jwks.get('/', async (c) => {
   // Derive the public key from the server signing key