FEAT: Add the 51Did (FodId) reader package (fiftyone.pipeline.did)

[oleksandrlazarenko-pi]

Summary

Adds fiftyone.pipeline.did, a strongly typed Node.js reader for the 51Did
(51Degrees Identifier) value returned by the 51Degrees Cloud service. Mirrors
the .NET FiftyOne.Did package and the Java/Python/PHP ports.

What it does

• FodId parses a 51Did from its base64 OWID form and exposes the payload
  fields — flags, licenseId (unsigned little-endian via >>> 0), hash
  (the stable value, defensive Uint8Array copy), and type — plus the
  OWID-level fields via the wrapped envelope.
• Implements the live Type model (flag bits 6-7: Probabilistic / Random /
  HashedEmail / Reserved) with per-type value length (16 or 32 bytes).
• Composition over the owid-js instance. Construction does not verify
  the signature; verify(publicPem) is an explicit, separate call and is
  async (Web Crypto).

OWID dependency

Builds on owid-js, consumed from the 51Degrees/owid-js fork as a git submodule
(owid-js/, file:../owid-js), pinned to its feature/offline-verify branch.
owid-js is verify-only/browser-first and had no offline verify with a
caller-supplied key, so the fork was extended with
verifyWithPublicKey(pem, others) (Web Crypto, Node + browser) and given
package metadata so it can be required.

The submodule will be repointed to owid-js main once the fork PR
(51Degrees/owid-js#1) lands;
the upstream change is SWAN-community/owid-js#6.

Tests & example

• tests/fodId.test.js (Jest): the full ported .NET suite including the
  Type-model cases plus the runbook gap tests — 31 tests, all passing.
  Parse tests build envelopes with a dummy signature; the two crypto tests
  (verifiable / wrong-key-false) sign for real via Node Web Crypto and verify
  offline through the extended owid-js.
• examples/fodIdExample.js — a self-contained offline example (build, parse,
  compare two 51Dids: same value, different envelopes).

Notes for reviewers

• verify() is asynchronous (returns a Promise<boolean>); construction is
  synchronous.
• owid-js exposes no instance asBase64, so FodId.asBase64() returns the
  original base64 the instance was created from.
• null arguments throw TypeError; a too-short payload throws RangeError.
• Run: git submodule update --init && npm install && npm test.

[Jamesr51d]

Does the new package need to mbe added here https://github.com/51Degrees/pipeline-node/blob/main/ci/build-package.ps1#L8

[Jamesr51d]

https://github.com/51Degrees/pipeline-node/blob/feature/51did-reader/ci/update-packages.ps1#L6 I think that the package needs to be added here as well.

[oleksandrlazarenko-pi]

Thanks James — both addressed:

1. package.json owid dependency — switched from the file:../owid-js path to a proper git URL: "owid": "github:51Degrees/owid-js#main". npm now pulls owid-js straight from the repo (which already has the offline verifyWithPublicKey), so there's no local path. As a result the owid-js submodule is now redundant and I've removed it (.gitmodules cleaned up too) — that also clears the earlier "proper link rather than a file path" comment, since there's no submodule path left at all.

2. CI package lists — fiftyone.pipeline.did is now registered in ci/build-package.ps1, ci/build-project.ps1, and (per your latest note) ci/update-packages.ps1.

Verified locally: npm install resolves owid from GitHub and all 32 unit tests pass.