Identities (manual override) endpoints

Currently stored client-side in localStorage under kilasec.identities; the cloud-backed /v1/identities table replaces it in an upcoming release.

When live, the shape will look like:

GET    /v1/identities
PUT    /v1/identities                              # upsert {key_type, key_value, name, principal_type, notes}
DELETE /v1/identities/{key_type}/{key_value}
GET    /v1/identities/suggestions                  # observed in audit but unnamed

key_type is one of ip / mac / hostname / key_fp / ua_prefix. The "first match" priority for the cloud-side display join goes:

1. key_fp match
2. mac match
3. hostname match
4. ip match

For the philosophy of why this lives in a separate table (renames-apply-retroactively), see Concepts: Identity model.