Hosted credential tour rejects documented demo identity

[jeremi]

Found during #198 fresh-reader verification against the current published docs / origin/main readiness path.

Steps

1. Open https://docs.registrystack.org/start/credential-tour/ and follow the Wallet test flow linked from https://lab.registrystack.org/.
2. Create or open a hosted wallet at https://wallet.lab.registrystack.org/signup.
3. Start issuance from https://citizen-notary.lab.registrystack.org/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt.
4. In eSignet, choose OTP login.
5. Enter the documented demo identity NID-2001 and OTP 111111.

Expected

The sign-in succeeds and the Notary renders a credential offer for person_is_alive_sd_jwt, so the hosted wallet can receive the Person is alive proof.

Actual

eSignet stays on the OTP screen and displays:

errors.relay_auth_subject_denied

This matches the known blocker noted on #198, but there was no separate issue to link as the verification acceptance requests.

Environment

• Date: 2026-07-09
• Docs: current published Latest docs
• Browser automation: Playwright against hosted lab
• Host: macOS 26.4.1 arm64

No production credentials or private data were used; only public synthetic hosted-lab demo identities were exercised.