feat: implement location retrieval api

CAMARA Location Retrieval v0.5

• New endpoint POST /location-retrieval/v0.5/retrieve. Takes a CAMARA request ("where is this phone?"), calls SRM's internal query, and translates the answer back. It's a questio, answered immediately over HTTP, nothing queued and nothing stored. Vendored spec added and covered by a conformance test.
• Translation in both directions is the whole job. CAMARA words on the outside, canonical words on the wire: maxAge → max_age_seconds, areaType: "CIRCLE" → area_type: "circle", radius → radius_m. SRM tells us which identifier the network actually used, and we echo that one device back, CAMARA requires exactly one, even when the caller sent several.
• SRM refusals become the right CAMARA code. SRM answers with an RFC 7807 problem; we key off its type, not the status, so …/unable-to-fulfill-max-age becomes LOCATION_RETRIEVAL.UNABLE_TO_FULFILL_MAX_AGE, "no such subscriber" becomes 404 IDENTIFIER_NOT_FOUND, and an unrecognised one falls back to SERVICE_NOT_APPLICABLE rather than leaking a 500. Scoped to sync queries so it can't misfire on the async paths.
• Bad input is rejected here, not two hops downstream. IPv4 and IPv6 addresses are validated at the edge, so a malformed address is a clear 400 INVALID_ARGUMENT instead of a confusing "service unavailable" from deep inside the platform. Also fixes the full CAMARA DeviceIpv4Addr being sent to SRM — a public IP alone doesn't identify a device behind carrier NAT, so the port and private address go too.
• Service specification ids are now calculated, not hard-coded. QoD and Location have no sign-up step, so both use a well-known catalog id. OEG and SRM each derive it from the same recipe rather than pasting a UUID, so the two sides can't drift apart. Same change landed in SRM.
• One correlation id per request, used everywhere — the inbound x-correlator, the internal call to SRM, and the response header all carry the same value (generated at the edge if the client sends none). 560 tests pass, pre-commit clean.