Persistent participant registry (plans_participants + API)

Closes gap-analysis v2 §4 + §10.9.

- Migration 005 adds plans_participants (plan_id, participant_id, role,
  lei, did, created_at) with a composite UNIQUE(plan_id, role,
  participant_id) and CHECK on role vocabulary matching types/plan.ts.
- services/participants.ts: idempotent add() / bulkAdd() / listForPlan() /
  listByRole() / remove() — the SoD layer reads listByRole() to resolve
  the authorised actor set for a transition.
- api/participants.ts + wiring in index.ts:
    GET    /api/plans/:planId/participants
    POST   /api/plans/:planId/participants          -> participants.authorized
    DELETE /api/plans/:planId/participants/:role/:participantId
- 7 unit tests against a Map-backed query stub; full suite 87/87 green.

orchestrator/src/index.ts

@@ -16,6 +16,7 @@ import { logger } from "./logging/logger";
 import { getMetrics, httpRequestDuration, httpRequestTotal, register } from "./metrics/prometheus";
 import { healthCheck, readinessCheck, livenessCheck } from "./health/health";
 import { listPlansEndpoint, createPlan, getPlan, getPlanState, getPlanEvents, streamPlanEvents, addSignature, validatePlanEndpoint } from "./api/plans";
+import { listParticipants, addParticipant, removeParticipant } from "./api/participants";
 import { streamPlanStatus } from "./api/sse";
 import { executionCoordinator } from "./services/execution";
 import { runMigration } from "./db/migrations";
@@ -94,6 +95,9 @@ app.get("/api/plans/:planId/events", getPlanEvents);
 app.get("/api/plans/:planId/events/stream", streamPlanEvents);
 app.post("/api/plans/:planId/signature", addSignature);
 app.post("/api/plans/:planId/validate", validatePlanEndpoint);
+app.get("/api/plans/:planId/participants", listParticipants);
+app.post("/api/plans/:planId/participants", auditLog("ADD_PARTICIPANT", "plan"), addParticipant);
+app.delete("/api/plans/:planId/participants/:role/:participantId", auditLog("REMOVE_PARTICIPANT", "plan"), removeParticipant);
 
 // Execution endpoints
 import { executePlan, getExecutionStatus, abortExecution } from "./api/execution";