Add read-only capability tokens

registry/amduatd-api-contract.v1.json

@@ -6,6 +6,8 @@
     {"method": "GET", "path": "/v1/meta"},
     {"method": "HEAD", "path": "/v1/meta"},
     {"method": "GET", "path": "/v1/contract"},
+    {"method": "POST", "path": "/v1/capabilities"},
+    {"method": "GET", "path": "/v1/cap/resolve"},
     {"method": "GET", "path": "/v1/fed/records"},
     {"method": "GET", "path": "/v1/fed/artifacts/{ref}"},
     {"method": "GET", "path": "/v1/fed/status"},
@@ -24,6 +26,22 @@
     {"method": "POST", "path": "/v1/context_frames"}
   ],
   "schemas": {
+    "capability_mint_request": {
+      "type": "object",
+      "required": ["kind", "target", "expiry_seconds"],
+      "properties": {
+        "kind": {"type": "string"},
+        "target": {"type": "object"},
+        "expiry_seconds": {"type": "integer"}
+      }
+    },
+    "capability_mint_response": {
+      "type": "object",
+      "required": ["token"],
+      "properties": {
+        "token": {"type": "string"}
+      }
+    },
     "pel_run_request": {
       "type": "object",
       "required": ["program_ref", "input_refs"],