Function extract_identity 

pub fn extract_identity(headers: &HeaderMap, peer: Option<SocketAddr>) -> String

Resolve a stable identity from the request headers + peer addr. Used by the axum middleware; exposed here so tests can reuse it.