Active Entity Capacity +25

Adds 25 Active Entity Capacity (AEC) for eligible logical production entities in an ECZ-ID estate. Individual IoT device instances use separate Fleet Capacity.

AEC changes operating capacity, not identity evidence tier. Capacity exhaustion does not revoke an identity or its public Resolver baseline.