feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

docs/api/gateway/export-center.md

@@ -1,17 +1,79 @@
 # Export Center Gateway Contract (draft placeholder)
 
-**Status:** TODO · awaiting Export Center Guild inputs
+**Status:** Draft v0.2 · owner-proposed
 
 ## Scope
 - Profile, run, download, and distribution routes proxied via Web gateway.
 - Tenant scoping, RBAC/ABAC, streaming limits, retention/encryption parameters, signed URL policy.
 
-## Needed from owners
-- OpenAPI/JSON schema for: profiles, runs, downloads, distributions (OCI/object storage).
-- Range/streaming limits; retry/backoff guidance; checksum/manifest format.
-- Required headers (tenant/project, idempotency, auth) and rate limits.
-- Example payloads/NDJSON streams for happy-path and error cases.
+## Endpoints
+- `GET /export-center/profiles` — list export profiles (tenant-scoped).
+- `POST /export-center/runs` — start an export run.
+- `GET /export-center/runs/{runId}` — run status and artifacts.
+- `GET /export-center/runs/{runId}/events` — SSE for run progress.
+- `GET /export-center/distributions/{id}` — fetch signed URLs for OCI/object storage distribution.
 
-## TODO
-- Replace this file with the ratified contract and sample payloads.
-- Record schema hash and date when published; link from Web II sprint Execution Log.
+## Security / headers
+- `Authorization: DPoP <token>`; `DPoP: <proof>`
+- `X-StellaOps-Tenant: <tenantId>` (required)
+- `X-StellaOps-Project: <projectId>` (optional)
+- `Idempotency-Key` (recommended for POST)
+- Required scopes (proposal): `export:read`, `export:write`.
+
+## Request: POST /export-center/runs
+```jsonc
+{
+  "profileId": "export-profile::tenant-default::daily-vex",
+  "targets": ["vex", "advisory", "policy"],
+  "formats": ["json", "ndjson"],
+  "distribution": {
+    "type": "oci",
+    "ref": "registry.local/exports/daily",
+    "signing": { "enabled": true, "keyRef": "k8s://secrets/eks/oci-signer" }
+  },
+  "retentionDays": 30,
+  "encryption": { "enabled": true, "kmsKey": "kms://tenant-default/key1" },
+  "priority": "normal"
+}
+```
+
+## Response: 202 Accepted
+- `runId`, `status: queued|running|succeeded|failed|expired`, `estimateSeconds`, `retryAfter`.
+
+## Response: GET run
+```jsonc
+{
+  "runId": "export-run::tenant-default::2025-12-06::0003",
+  "status": "running",
+  "profileId": "export-profile::tenant-default::daily-vex",
+  "startedAt": "2025-12-06T10:00:00Z",
+  "outputs": [
+    { "type": "manifest", "format": "json", "url": "https://exports.local/.../manifest.json?sig=...", "sha256": "...", "expiresAt": "2025-12-06T16:00:00Z" }
+  ],
+  "progress": { "percent": 35, "itemsCompleted": 70, "itemsTotal": 200 },
+  "errors": []
+}
+```
+
+## SSE events
+- `started`, `progress`, `artifact_ready` (url, sha256, type), `completed`, `failed` (code, message).
+
+## Limits (proposal)
+- Max request body 256 KiB; max targets 50; default timeout 60 minutes.
+- Idle SSE timeout 60s; backoff with `Retry-After`.
+
+## Error codes (proposal)
+- `ERR_EXPORT_PROFILE_NOT_FOUND`
+- `ERR_EXPORT_REQUEST_INVALID`
+- `ERR_EXPORT_TOO_LARGE`
+- `ERR_EXPORT_RATE_LIMIT`
+- `ERR_EXPORT_DISTRIBUTION_FAILED`
+
+## Samples
+- Profile list sample: _todo_
+- Run request/response: see above snippets.
+- Events NDJSON: _todo_
+
+## Outstanding (for finalization)
+- Confirm scopes, limits, distribution signing rules, and manifest checksum requirements.
+- Provide full OpenAPI/JSON schema and sample artifacts for OCI/object storage distributions.