LIR: End-User KYC via Stripe Identity

[v0l]

Part of the LIR sponsoring epic (see #39).

Sponsored ASN / PI resources make us the responsible LIR, so RIPE requires us to verify and hold the End Users identity (registration due diligence) and produce it on an ARC audit. A pseudonymous npub signature alone is not attributable to a legal person, so identity verification is the blocker for the whole sponsoring product.

We do not want to be on the hook for forged documents, so verification is delegated to Stripe Identity (Stripe is already integrated as a payment provider in payments/stripe.rs).

Scope

• kyc_record (registrant) table: verified legal name, entity type, registration/tax number, address, country, status (pending/verified/rejected), verifier/timestamp, Stripe Identity verification_session_id + result, and the npub it is bound to. Migration + model + DB traits + mysql + mock.
• Stripe Identity integration: create a VerificationSession, redirect/return flow, and a webhook handler (identity.verification_session.verified / .requires_input) that flips the record to verified/rejected. Reuse existing Stripe keys/webhook plumbing where possible.
• User API: start verification, poll status. Admin API: list/inspect records.
• Bind the verified identity to the account (npub) so the LIR agreement and sponsored resources can reference it.

Notes

• RIPEs bar is registration due diligence, not financial AML — Stripe Identity (document + selfie) is sufficient and shifts forgery liability to Stripe.
• This is a deliberate KYC exception to LNVPS otherwise pseudonymous model; it applies only to sponsored ASN/PI, never to VPS.
• Not legal advice — confirm the approach and eIDAS signature tier with counsel + RIPE NCC.

Depends on: nothing. Blocks: LIR agreement persistence, ASN/PI fulfilment.