Epic: productionize LIR sponsoring (ASN + PI IP space)

[v0l]

Tracking issue for turning the LIR services product (#39) into a fulfillable, RIPE-compliant offering.

Already done (in progress on branch, not yet PR)

• ✅ Registry clients: RegistryProvider / RpkiProvider traits + RipeDb (RIPE whois route/route6) + Krill (delegated RPKI ROAs) — lnvps_api_common/src/registry/.
• ✅ IP-range fulfilment: IpRangeProvisioner (CIDR sub-allocation, allocation on payment, origin-ASN configure/re-home, expiry teardown) behind optional registry/RPKI providers; thin IpRangeLineItemHandler.
• ✅ ip_range_subscription.origin_asn as mutable state on the assignment row (not the immutable line-item config); PATCH /api/v1/ip_range/{id}.
• ✅ ASN DB foundation: asn_subscription table + AsnSubscription/AsnSubscriptionStatus model + traits + mysql + mock + resource resolution.

Remaining work

• LIR: End-User KYC via Stripe Identity #188 — End-User KYC via Stripe Identity (the compliance blocker)
• LIR: persist & bilaterally sign the Sponsoring LIR Agreement #189 — Persist & bilaterally sign the Sponsoring LIR Agreement
• LIR: ASN sponsoring provisioner, aut-num object & admin assignment flow #190 — ASN sponsoring provisioner, aut-num object & admin assignment flow
• LIR: registry/RPKI provider config layer (RIPE IRR + Krill) per company/IP block #191 — Registry/RPKI provider config layer (RIPE IRR + Krill) per company/IP block

Key decisions

• KYC via Stripe Identity — RIPE requires End-User identity due diligence for sponsored resources; delegating to Stripe Identity shifts forgery liability and avoids building IDV. Sponsored ASN/PI is a deliberate KYC exception to LNVPS otherwise pseudonymous model.
• Delegated RPKI via Krill — RIPE hosted RPKI is LIR-only and cannot sign sponsored space.
• RPKI is optional — ROV is not universal; route object (IRR) is the more commonly required artifact.
• Fulfilment gate — no RIR request / aut-num / route object for sponsored PI until KYC verified (LIR: End-User KYC via Stripe Identity #188) + signed agreement on file (LIR: persist & bilaterally sign the Sponsoring LIR Agreement #189).

⚠️ Not legal advice — confirm the agreement clauses, e-signature tier (eIDAS), and identity-verification approach with counsel and RIPE NCC before going live.