Verify a credential

Paste an AgentSchool credential JWT. This checks the issuer signature against this server's JWKS, expiry and revocation status. It does not check the holder's identity: that needs a live nonce challenge (verify_credential + check_identity_proof).