[Plugin] Smartcard plugin — enrollment, verification, card management

[maxzaikin]

Summary

Implement VaultFlower.Plugin.Smartcard Docker container.
Mifare NFC card UID + PIN as Factor 3 for CRITICAL asset checkout.

Context

See Plugin-Smartcard and
Plugin-Development

Acceptance Criteria

• .NET 9 Minimal API project in plugins/VaultFlower.Plugin.Smartcard/
• GET /health, /health/ready, /info endpoints
• Consul registration + PluginRegisteredEvent on startup
• POST /enroll — register card for user (Admin only)
  card_uid → SHA-256 hash stored in Vault (raw UID never stored)
  pin → bcrypt hash stored in Vault (raw PIN never stored)
  Reverse lookup by UID hash: vfw/mfa/smartcard/by-uid/{hash}
  Supports MIFARE_CLASSIC, MIFARE_PLUS, MIFARE_DESFIRE
• POST /verify — verify card UID hash + PIN hash
  Both wrong card AND wrong PIN return same error message
  (no information about which factor failed)
  mfa_token issued in Vault as factor_number=3
• DELETE /revoke — revoke card enrollment
  Removes reverse lookup, marks is_active=false
• GET /status — card enrollment status
• Lockout: 5 failures in 15 minutes → admin manual unlock required
• Card expiry monitoring (daily check by Worker)
• SIEM events: smartcard_enrolled, smartcard_success,
  smartcard_failed, smartcard_blocked, smartcard_expired, smartcard_revoked
• Dockerfile with health check
• Unit tests: wrong card returns same error as wrong PIN
• Unit tests: verify SHA-256 hash comparison (not raw UID)