feat(vc): upgrade to W3C VC Data Model v2.0 (Phase 1, dual-accept)

[MoltyCel]

Summary

• Newly issued credentials are now W3C VC Data Model v2.0: @context points to https://www.w3.org/ns/credentials/v2, timestamp fields are validFrom / validUntil.
• verify_credential is dual-accept: still recognises legacy v1 envelopes (issuanceDate / expirationDate) so credentials minted before this PR keep verifying until the dataset rotates.
• Two helpers (vc_valid_from, vc_valid_until) replace direct field reads at every DB-insert call-site.

Wire-Check (before)

@context: ["https://www.w3.org/2018/credentials/v1", "https://api.moltrust.ch/contexts/trust/v1"]
issuanceDate / expirationDate

Wire-Check (after)

@context: ["https://www.w3.org/ns/credentials/v2", "https://api.moltrust.ch/contexts/trust/v1"]
validFrom / validUntil

Touched files

File	Change
app/credentials.py	v2 emit + vc_valid_from / vc_valid_until helpers + dual-read in verify_credential
app/swarm/endorsement.py	SkillEndorsementCredential emitted as v2
app/main.py	VerifiedMusicCredential (both build paths) as v2; DB-insert call-sites switched to helpers
backfill_credentials.py, agent/ambassador.py	Helper-based reads
tests/test_credentials_vc_v2.py	New — 10 tests (helpers + roundtrip + v1 legacy verify + expiry)

Out of scope (intentional)

• credentialSubject.provenance.issuanceDate on Music VCs — internal MolTrust vocabulary, not the W3C VC core field.
• ViolationRecord (@context: https://moltrust.ch/ns/violation/v1) — not a W3C VC, no VerifiableCredential type.

Test plan

• pytest tests/test_credentials_vc_v2.py — 10/10 pass (server scratch checkout w/ venv)
• Import-smoke (CI-style env): from app.main import app → OK
• Syntax check: python -m compileall on all touched files → clean
• Post-merge: smoke a real /credentials/issue against staging, confirm response carries validFrom/validUntil not issuanceDate/expirationDate
• Post-merge: smoke /credentials/verify against a legacy v1 credential pulled from the credentials table — confirm it still validates

Notes for review

• Phase 1 = backwards-compat. Phase 2 (later sprint) would: drop v1 verify path, migrate existing raw_vc rows in credentials table, retire helpers.
• DB schema unchanged — issued_at / expires_at columns absorb the v2 timestamps just fine via the helpers.

🤖 Generated with Claude Code