fix(storage): harden the KVS-backed identity and wallet stores

[AkramBitar]

Fixes #2041

Six fixes in token/services/storage/db/kvs:

1. Vault key collisions — composite-key components are percent-escaped, so an empty component, a / inside one (base64 identity hashes have them) or a ./.. can no longer make two different keys point at the same secret.
2. Iterator — a key deleted between the list and its read is skipped, not yielded as an empty record.
3. StoreIdentity — the entry IdentityExists reads is written last and every write is idempotent, so a partial failure reads as "not stored" and a retry converges.
4. tracker.go — history entries are snapshots, not the caller's pointer.
5. fscKVS.Close() — returns the store's close error instead of only logging it.
6. Test helper — closes the HTTP response body on success.

Also fixed in the same code: a nil iterator for an empty list (panicked in IdentityConfigurationsIterator), an unchecked value.(string), and an unclosed iterator in GetWalletIDs.

Warning

Storage-format change: Vault entries whose key components contain / or % now live at a different path and are not found by the new code. See docs/services/storage/kvs.md.

IdentityExists returns (bool, error)

A second commit adopts the WalletStoreService.IdentityExists signature from #2409, so a failed lookup is no longer indistinguishable from "the binding does not exist". The KVS store previously swallowed the composite-key error and answered false; it now wraps it. Only key construction can be reported that way, because this backend's Exists is FSC's GetExisting, which drops the underlying store error — the caveat already documented on GetWalletID.

Registry.ContainsIdentity cannot grow an error return (it backs driver.Wallet.Contains, a plain bool), so it logs the failure before reporting false.

Note

This duplicates the IdentityExists slice of #2409 verbatim — #2409 already updates kvs/walletdb.go itself, so taking the signature here also means taking the interface, sql/common/wallet.go, the mock and the test callers. The overlapping hunks are byte-identical, so whichever PR merges second drops them as already-applied rather than conflicting. If #2409 lands first, this commit can simply be dropped.

The issue's perf suggestion (hash-first keys) is left out — it needs a secondary index plus a scan fallback for existing data, so it belongs in its own change.

Tests: unit + fuzz for the key/path round trip (in the nightly fuzz matrix), a Vault-backed case for /, empty, .. and % components plus a key deleted after the list, and a tracker regression test. New page docs/services/storage/kvs.md.

[Effi-S]

Some Findings:

1. Backward-incompatible Vault storage format — Medium

Location: token/services/storage/db/kvs/hashicorp/vault_kvs.go — NormalizeID
Keys with / or % (identity hashes routinely contain /) now map to different Vault
paths, so existing deployments stop finding previously written identity/wallet data. Called
out in a doc WARNING but there is no migration tooling — upgraders must re-register affected
identities manually. Confirm this is acceptable / has a migration story.

2. KVS IdentityExists cannot surface read failures — Medium

Location: token/services/storage/db/kvs/walletdb.go — IdentityExists
The new (bool, error) return only ever carries a key-construction error; kvs.Exists still
swallows Vault read errors (FSC GetExisting), so a transient failure reads as "not bound"
for the KVS backend. The hardening goal (fault ≠ non-membership) is only actually met by the
SQL backend. Documented, but the KVS half of the change is effectively inert.

3. Context threaded but not used for Vault I/O — Low

Location: token/services/storage/db/kvs/hashicorp/vault_kvs.go — read (ignores ctx),
Get, iterator
ctx is now plumbed through but read calls client.Logical().Read(...), not
ReadWithContext. Cancellation/deadlines are not honored. Cosmetic threading; switch to the
*WithContext Vault calls to make it real.

4. StoreIdentity intermediate inconsistency window — Low

Location: token/services/storage/db/kvs/walletdb.go — StoreIdentity
The GetWalletID key [tmsID, roleID, idHash] is written before the IdentityExists key.
A failure between them leaves GetWalletID returning a wallet while IdentityExists reports
false. Retries converge (writes are idempotent), so low impact, but the two reads disagree
in the window. Acceptable if IdentityExists is the sole commit marker.