feat: add RFC-3161 timestamping (internal/evidence)

HTTPTimestamper builds a Request directly from a precomputed SHA-256
digest (Request{HashAlgorithm, HashedMessage, Nonce}.Marshal(), not
CreateRequest(io.Reader) which would hash the input itself), POSTs it to
a TSA, and validates that the parsed response's hash algorithm, hashed
message and nonce actually match what was sent before accepting the
token — a response that doesn't match the request isn't a valid
timestamp for that hash, regardless of whether it parses.

Uses github.com/digitorus/timestamp for the RFC-3161/ASN.1 encoding
rather than hand-rolling it.

TSA choice (open point in CLAUDE.md): FreeTSA.org for now — free,
RFC-3161-compliant, verified end-to-end with a live smoke test, but
not eIDAS-qualified. Documented as needing an upgrade to a qualified
provider (D-Trust, Bundesdruckerei, ...) before real customer use, same
treatment as the open legal questions in rules/OPEN.md.

Tests cover request/response validation without network (hash size
guard, a fake server that parses and checks the incoming request,
non-200 and malformed-response handling) plus a real integration test
against FreeTSA gated behind DEKLARIX_TSA_INTEGRATION, mirroring the
DATABASE_URL-gated pattern in internal/store.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -377,6 +377,12 @@ journalctl -u deklarix -f
 ## Offene Punkte
 
 - Umfang des Regelsatzes für den ersten Pilotkunden festlegen
-- Welche TSA für die Zeitstempel
+- **TSA für die Zeitstempel:** interimsweise FreeTSA.org (frei, RFC-3161-
+  konform, siehe `internal/evidence.DefaultTSAURL`) — funktioniert
+  technisch, ist aber **nicht eIDAS-qualifiziert**. Vor echtem
+  Kundeneinsatz auf einen eIDAS-qualifizierten Zeitstempeldienst (z. B.
+  D-Trust, Bundesdruckerei) umstellen, der die gesetzliche
+  Vermutungswirkung nach eIDAS Art. 41 hat — dafür ist ein Vertrag/Account
+  nötig, kein anonymer HTTP-Call.
 - Löschkonzept versus Beweisarchiv sauber ausformulieren
 - Markenanmeldung Deklarix, sobald erster Kunde zahlt