Add schema deactivation by original issuer #25

Description

Schemas cannot be deactivated once registered. If an issuer retires a credential type, they should mark the schema inactive to prevent new credentials being issued under it.

Tasks

• Add deactivate_schema(env, issuer, schema_id)
• Validate: caller is original schema owner
• Set schema.active = false
• Emit schema_deactivated event
• Verify issue_credential rejects inactive schemas
• Add test: deactivate then issue — should panic

Acceptance Criteria

• Non-owner cannot deactivate
• Issuing against inactive schema panics
• Existing credentials remain valid after deactivation

Complexity: Medium (150 pts)