Document Sigma identity appliance topology [OPL-4470]

[rohenaz]

Problem

The BRC-169 rollout lacked a proven deployment boundary and consumer inventory. Without one, adding the service to an existing shared host could disrupt Yours Wallet, Sigma Auth, BAP consumers, or the separate BSocial/Sigma Social stack.

Change

• define overlay.sigmaidentity.com as a proposed independent Sigma identity appliance built from the configurable 1sat-stack binary
• explain what the dedicated host/failure domain contains and how staging differs from production
• inventory observed behavior and consumers across api.1sat.app, sigma.1sat.app, api.sigmaidentity.com, Sigma Social, Sigma Auth, 1sat-sdk, bsv-bap, and Yours Wallet
• document ingress, module profile, persistence/BEEF dependencies, key custody, readiness, backup/restore, canaries, rollback, and non-breaking cutover gates
• distinguish verified evidence, inference, and unresolved operations questions
• keep DNS, deployment, advertisement, social work, and existing consumer behavior explicitly unchanged

Verification

• internal documentation links resolve
• whitespace and diff checks pass
• independent GPT-5.6 Sol high-reasoning review: clean after factual consumer and SHIP/SLAP rollback corrections

Linear: OPL-4470

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[linear]

OPL-4470