Summary
- Add pds_client module with handle resolution (DNS TXT + HTTP fallback), PDS discovery from plc.directory, OAuth authorization server metadata fetching
- Implement PDS OAuth helpers (PAR, token exchange, authorize URL construction) and XRPC identity methods (requestPlcOperationSignature, signPlcOperation, getRecommendedDidCredentials)
- Wire PdsClient into AppState for Phase 4 Tauri command access
- 33 pds_client tests + 19 identity_store tests (136 total passing)
Test plan
- cargo test --package identity-wallet -- --test-threads=1 (136 pass, 3 ignored)
- cargo clippy --package identity-wallet -- -D warnings (clean)
- cargo fmt --all --check (clean)
- Manual: DNS TXT resolution (--ignored test) — see docs/test-plans/2026-03-28-plc-key-management.md Phase 5
- Manual: Full OAuth Safari/deep-link flow — see test plan Phase 6
- Manual: Secure Enclave device key on physical iOS device — see test plan Phases 1-4