Complete identity smoke path: id_token claims, registration entry, cutover docs

Prefer verified KeyCape id_token claims when /userinfo returns 401; soft-fail
userinfo. Add CSOC-WP-0003 registration entry (disabled until NetKingdom URL),
AAL step-up hooks, smoke/cutover evidence for tegwick OIDC without MFA.

coulomb_social/apps/core/context_processors.py

@@ -6,4 +6,5 @@ def site_context(request):
         "site_name": "coulomb.social",
         "default_tenant_id": settings.DEFAULT_TENANT_ID,
         "oidc_enabled": settings.OIDC_ENABLED,
+        "registration_enabled": bool(settings.NETKINGDOM_REGISTRATION_URL),
     }