findActiveByDid
Finds all active (non-revoked) authorization records for a DID.
Uses in-memory cache if available (no cipher needed for cached reads). If the cache is cold and the file exists, requires a decrypt cipher.
Return
List of active records for this DID
Parameters
did
The user's DID
decryptCipher
Pre-authenticated cipher (DECRYPT_MODE), or null if cache is warm
Throws
if cache is cold and no cipher provided