Phase 5: Wire domain config into identity driver selection

[gtema]

Scope

Integrate domain config into the identity provider so per-domain driver dispatch works end-to-end.

Tasks

Identity provider changes

• Currently identity operations use a single global driver
• Modify identity provider to look up domain config before selecting a driver
• Per-domain identity backend resolution: given a domain_id, look up identity.driver and dispatch to the appropriate backend
• Identity provider needs to hold references to multiple identity backends (SQL + LDAP) and dispatch based on domain config

CLI commands (optional)

• domain_config_upload --all / --domain-name NAME — migrate file-based config to DB
• mapping_purge — purge stale identity mappings

Parent issue

Part of #954