feat(applet): accessDocumentVerified flag in CredentialStore (M2A.1)

Persistent boolean flag for the cached IssuerAuth verify result. Field
sits beside accessDocumentFinalized in writeTo/readFrom (FIELD_VERSION
bumped 1->2 -- schema change requires re-personalize). reset() clears.
Test pins the serialize/deserialize round-trip via the existing
RecordingSink/ReplaySource helpers.

Foundation for M2A.2 (CoseVerifier) and M2A.3 (verify-at-finalize wiring).

applet/src/main/java/com/dangerousthings/aliro/CredentialStore.java

@@ -36,7 +36,7 @@ final class CredentialStore {
     /** Stable field order for AMD-H Element serialization. Append-only —
      *  never reorder or remove without bumping the package version and
      *  writing an explicit migration step in the new ELF's onRestore. */
-    static final byte FIELD_VERSION = 1;
+    static final byte FIELD_VERSION = 2;
 
     /** Publish-point read by AliroApplet/StepUpApplet via {@link #get()}.
      *  PersonalizationApplet owns the actual instance; this is just an alias
@@ -57,6 +57,7 @@ final class CredentialStore {
     private final byte[] accessDocument;
     private short accessDocumentLen;
     private boolean accessDocumentFinalized;
+    private boolean accessDocumentVerified;
 
     private boolean committed;
 
@@ -202,6 +203,14 @@ final class CredentialStore {
         return accessDocumentFinalized;
     }
 
+    void markAccessDocumentVerified() {
+        accessDocumentVerified = true;
+    }
+
+    boolean isAccessDocumentVerified() {
+        return accessDocumentVerified;
+    }
+
     short getAccessDocumentLen() {
         return accessDocumentLen;
     }
@@ -223,6 +232,7 @@ final class CredentialStore {
         sink.write(credentialPubKeySet);
         sink.write(readerPubKeySet);
         sink.write(accessDocumentFinalized);
+        sink.write(accessDocumentVerified);
         sink.write(accessDocumentLen);
         sink.write(credentialPrivKey);
         sink.write(credentialPubKey);
@@ -246,6 +256,7 @@ final class CredentialStore {
         s.credentialPubKeySet = src.readBoolean();
         s.readerPubKeySet = src.readBoolean();
         s.accessDocumentFinalized = src.readBoolean();
+        s.accessDocumentVerified = src.readBoolean();
         s.accessDocumentLen = src.readShort();
         byte[] a;
         a = src.readByteArray();
@@ -307,6 +318,7 @@ final class CredentialStore {
         readerPubKeySet = false;
         accessDocumentLen = 0;
         accessDocumentFinalized = false;
+        accessDocumentVerified = false;
         committed = false;
     }
 }