Add Rekor v2 mode, Ed25519ph, and persistent duplicate handling

[wolfv]

Summary

• Add mutually exclusive --mode tessera|rekor / LOG_MODE, with the mode pinned per database. Tessera remains the default.
• Implement Rekor v2 HTTP entry creation and tile/checkpoint routes, signature verification, canonical hashedrekord entries, and inclusion proofs against published signed checkpoints.
• Support the upstream default signing algorithms, including strict Ed25519ph/SHA-512 verification (public keys and certificates).
• Persist canonical leaf hashes atomically with sequencing. Exact retries return HTTP 409 / code 6 and x-log-index; Tessera retains append-every-request behavior.
• Fix partial-to-full entry bundle preservation, proof tile coordinates, and live-server rate limiting.
• Add Rust regression tests, PostgreSQL CI coverage, and an upstream rekor-tiles v2.3.0 interoperability test.

Verification

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• Concurrent deduplication, rollback, and restart tests against local PostgreSQL 17 and SQLite
• Upstream Go writer/verifier with race detection: 314 entries across all supported algorithms and tile boundaries, plus duplicate response checks

Scope

HTTP/JSON only; RSA-PSS, deprecated DSSE submissions, and gRPC are intentionally deferred. Different signatures/material remain different entries. Existing nonempty Tessera logs cannot be switched into Rekor mode.