Implement OID4VCI (OpenID for Verifiable Credential Issuance) credential endpoint for a wallet

Steps

1. The issuer publishes a credential issuer metadata document at /.well-known/openid-credential-issuer listing supported credential_configurations_supported, credential_endpoint, and authorization_server.
2. The wallet initiates a Credential Offer flow (QR code or deep link) or a direct authorization flow; it obtains an access token from the authorization server with the credential-specific scope.
3. The wallet calls the credential_endpoint POST with Authorization: Bearer <access_token> and a JSON body containing format (e.g. 'jwt_vc_json', 'mso_mdoc'), credential_configuration_id, and a proof (JWT or CWT) demonstrating key binding.
4. The issuer validates the access token, validates the proof (verify the JWT signature and nonce/c_nonce match), issues the credential signed with the issuer's key, and returns it in the credential field of the response.
5. For deferred issuance, the issuer returns transaction_id instead of credential; the wallet polls the deferred_credential_endpoint with the transaction_id until the credential is ready.