Migrate Simulator environment to validate inputs against formal schemas before processing.

[Hahfyeex]

this pr closes #571

• Enhanced validator with error codes and strict mode
• Added comprehensive request/response validation
• Integrated validator into Runner.Run() method
• Created 40+ test cases covering all validation paths
• Added performance benchmarks
• Updated architecture documentation
• No breaking changes to public interface

Core Implementation

• KmsEd25519Signer: New plugin class implementing AuditSigner interface

  • Direct AWS KMS SignCommand invocation
  • Ed25519 asymmetric signing algorithm
  • Environment-based key management (ERST_KMS_KEY_ID, ERST_KMS_PUBLIC_KEY_PEM, ERST_KMS_REGION)
  • Zero local key material storage

• Factory Integration: Extended createAuditSigner() to support 'kms' provider

  • Maintains backward compatibility with software and PKCS#11 signers
  • Case-insensitive provider selection
  • Proper error handling for missing configuration

• Dependencies: Added @aws-sdk/client-kms v3.609.0

  • Native AWS SDK integration
  • Automatic credential chain resolution
  • TLS 1.2+ transport security

Testing

• Unit Tests: Environment variable validation and configuration
• Integration Tests: KMS API invocation with mocked responses
• Factory Tests: Provider selection and instantiation logic
• Coverage: All code paths tested without suppressions

Documentation

• AWS_KMS_SIGNING_ARTIFACT.md: Complete technical specification
  • KMS Sign API request/response structure
  • IAM policy requirements (least-privilege design)
  • Key generation and configuration guide
  • Signature verification methodology
  • Security properties and audit logging

Security Properties

• Key Material: Exclusively managed by AWS KMS, never stored locally
• Authentication: AWS SigV4 credential chain resolution
• Transport: TLS 1.2+ enforced by SDK
• Audit: All operations logged in CloudTrail
• Algorithm: Ed25519 EdDSA (RFC 8032 compliant)