Support application-scoped provider resource resolution #290

What

Problem

Provider resources should be resolved from application-scoped resource
identifiers instead of exposing configured provider names directly to
applications.

The daemon currently does not provide a ResourceType::kProvider resolver.
Additional configuration parsing and ProviderManager support are required before
explicit provider resources can be used for context creation.

Until this is implemented, hash context creation rejects explicit provider
resources.

Scope

• Define configuration for mapping application resource identifiers to
  configured providers.
• Parse and validate the provider-resource mappings.
• Add a ProviderManager API for resolving a provider resource.
• Register a mediator resolver for ResourceType::kProvider.
• Enforce application/client scope during resolution.
• Return an opaque provider resource to the application.
• Allow context creation to use the resolved provider.
• Ensure explicit provider selection does not silently fall back.
• Add unit and integration tests.

References

• Follow-up to crypto: Migrate hash functionality from baselibs #237

Acceptance Criteria (DoD)

• Applications can resolve an application-scoped provider resource identifier.
• Unknown or unauthorized provider resources are rejected.
• Concrete provider names are not exposed to applications.
• A resolved provider resource can be used for context creation.
• Explicit provider selection never silently falls back.

How

No response