refactor(identity): rename the api-key directory config to provider

[hexfusion]

Summary

Rename the api-key resolver's backend selector from directory: to provider:, and the DirectoryConfig enum to ProviderConfig. Follow-up to #125, landed before the plugin has downstream adopters. Config surface only, no behavior change.

Motivation

The selector reads as directory: { kind: http }, but http and file are kinds of provider, not kinds of directory, so the noun and its kind: disagree. directory with kind: file also reads against the filesystem sense, a directory that contains a file. provider: { kind: http | file } reads as plain English and matches how operators already talk about an identity provider. The shared claim-mapping module from #119 already refers to the per-resolver piece as "provider-specific."

Example

Before:

config:
  credential:
    kind: header
    name: Authorization
  prefix: "Bearer sk-oai-"
  directory:
    kind: http
    url: https://maas-api.../internal/v1/api-keys/validate
  record_map:
    subject:
      id: username
      roles: groups

After:

config:
  credential:
    kind: header
    name: Authorization
  prefix: "Bearer sk-oai-"
  provider:
    kind: http
    url: https://maas-api.../internal/v1/api-keys/validate
  record_map:
    subject:
      id: username
      roles: groups

Only the outer key changes. The kind: file | http discriminator and every field under it are unchanged.

The file backend uses the same key, pointing at a local records file of digests:

config:
  credential:
    kind: header
    name: Authorization
  prefix: "Bearer sk-oai-"
  provider:
    kind: file
    path: /etc/ppe/keys.yaml
    index: sha256
    refresh_secs: 30
  record_map:
    subject:
      id: username
      roles: groups

# /etc/ppe/keys.yaml
keys:
  - hash: "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
    username: alice
    groups: [team-a]

What changed

Renamed the directory field to provider and the DirectoryConfig enum to ProviderConfig, and updated the cache-over-file validation message, the factory.rs config example, the two backend KIND doc lines, and the test config keys. The KeyDirectory trait, DirectoryError, and the directory module keep their names, so the record-directory concept and the internal plumbing are unchanged. The serde tag = "kind" and the kind: file | http shape are unchanged, so only the outer key name moves. cargo build, cargo test (80 passing), cargo clippy, and cargo fmt --check are green for the plugin.

[araujof]

LGTM