UPDATE SSF transmitter for CAEP Interop push Stream Management

[ParleSec]

What does this PR do?

Aligns the existing SSF transmitter with the OpenID CAEP Interop Profile Stream Management surface for the push delivery variant (ssf_profile=caep_interop, delivery_methods=push).

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Enhancement (improvement to existing functionality)
• Documentation update
• Refactoring (no functional changes)
• New protocol implementation

How was this tested?

• Ran the affected flow in Looking Glass and verified real-time events
• Tested locally with cd backend && go run ./cmd/server and cd frontend && npm run dev
• Other (describe below)

go test ./internal/protocols/ssf ./internal/protocols/oauth2 ./internal/core plus the full validation checklist below. New coverage lives in caep_interop_test.go (metadata, stream lifecycle without Looking Glass headers, OAuth isolation, query-token rejection, SET profile, external push listener) and TestSSFClientCredentialsIssuesShortLivedResourceAudience.

Validation checklist

• Backend: cd backend && go build ./... && go test ./...
• Backend lint: cd backend && golangci-lint run ./...
• Frontend: cd frontend && npm run lint && npx tsc --noEmit && npm run build
• Frontend references: cd frontend && npm run verify-refs
• JWK thumbprint (RFC 7638): cd frontend && npm run verify-jwk-thumbprint
• DPoP proof generation / deep-links (RFC 9449): cd frontend && npm run verify-dpop
• Wallet UI: cd wallet-ui && npx tsc --noEmit && npm run build
• Docs: cd docs/starlight && npm run build
• OpenAPI: npx @redocly/cli lint --config redocly.yaml gateway@v1 scim@v1 federation@v1 vc@v1
• Docker/topology: cd docker && docker compose config
• OID4VCI/OID4VP conformance: cd backend && go test ./internal/protocols/oid4vci ./internal/protocols/oid4vp -count=1

Checklist

• My commits are signed off (git commit -s) per the DCO
• I have read the CONTRIBUTING guide
• I selected the relevant validation checks above
• I have updated documentation if needed
• I have not committed secrets, credentials, or .env files

Screenshots / Looking Glass output