Fix DID verification method ID encoding and add controller (#48)

## Summary
Fixed the DID document generation to correctly encode verification
method IDs and set the controller field.

## Key Changes
- **Fixed fragment encoding**: Changed `doc.Fragment("#key-0")` to
`doc.Fragment("key-0")` to prevent double-encoding of the `#` character.
The `Fragment()` method automatically prepends `#`, so passing `#key-0`
resulted in `#%23key-0` in the serialized output.
- **Set verification method controller**: Added `vm.Controller = doc.ID`
to properly associate the verification method with the DID document.
- **Added test coverage**: Created comprehensive test
(`TestDIDDocument`) that validates:
  - DID document generation succeeds
  - Document ID matches the service DID
- Verification method ID is correctly formatted as
`did:web:example.com#key-0`
  - Verification method ID does not contain percent-encoded characters
  - Verification method controller is set to the document ID

## Implementation Details
The fix ensures that DID documents conform to the W3C DID specification
by properly formatting the verification method ID and establishing the
correct controller relationship.

https://claude.ai/code/session_01YAjDX5F44mcX8ojb1ENjY

## References

- fil-forge/smelt#11

Author: bajtos

identity/identity.go

@@ -63,7 +63,10 @@ func (i Identity) DIDDocument() (did.Document, error) {
 	if !ok {
 		return did.Document{}, fmt.Errorf("identity does not have a multikey verifier")
 	}
-	vm := multikey.DeriveVerificationMethod(doc.Fragment("#key-0"), mkVerifier)
+	// Fragment expects a bare name and prepends the "#" itself; passing "#key-0"
+	// would serialize as "#%23key-0".
+	vm := multikey.DeriveVerificationMethod(doc.Fragment("key-0"), mkVerifier)
+	vm.Controller = doc.ID
 
 	if err := doc.VerificationMethods.Add(vm); err != nil {
 		return did.Document{}, err

identity/identity_test.go

@@ -0,0 +1,40 @@
+package identity_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/fil-forge/libforge/identity"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDIDDocument(t *testing.T) {
+	const serviceDID = "did:web:example.com"
+
+	id, err := identity.New("", serviceDID)
+	require.NoError(t, err)
+
+	doc, err := id.DIDDocument()
+	require.NoError(t, err)
+
+	docJSON, err := json.Marshal(doc)
+	require.NoError(t, err)
+
+	var parsed struct {
+		ID                 string `json:"id"`
+		VerificationMethod []struct {
+			ID         string `json:"id"`
+			Controller string `json:"controller"`
+		} `json:"verificationMethod"`
+	}
+	require.NoError(t, json.Unmarshal(docJSON, &parsed))
+
+	require.Equal(t, serviceDID, parsed.ID)
+	require.Len(t, parsed.VerificationMethod, 1)
+
+	vm := parsed.VerificationMethod[0]
+	require.Equal(t, serviceDID+"#key-0", vm.ID)
+	require.False(t, strings.Contains(vm.ID, "%23"), "verification method ID must not contain a percent-encoded '#'")
+	require.Equal(t, serviceDID, vm.Controller)
+}