feat(applet): accessDocumentVerified flag in CredentialStore (M2A.1)

Persistent boolean flag for the cached IssuerAuth verify result. Field
sits beside accessDocumentFinalized in writeTo/readFrom (FIELD_VERSION
bumped 1->2 -- schema change requires re-personalize). reset() clears.
Test pins the serialize/deserialize round-trip via the existing
RecordingSink/ReplaySource helpers.

Foundation for M2A.2 (CoseVerifier) and M2A.3 (verify-at-finalize wiring).

applet/src/test/java/com/dangerousthings/aliro/CredentialStoreSerializationTest.java

@@ -81,6 +81,20 @@ class CredentialStoreSerializationTest {
         assertFalse(restored.hasAccessDocument());
     }
 
+    @Test
+    void accessDocumentVerifiedRoundTripsThroughSerialize() {
+        CredentialStore s1 = CredentialStore.bootstrap();
+        s1.resetForTesting();
+        s1.markAccessDocumentVerified();
+
+        RecordingSink buf = new RecordingSink();
+        s1.writeTo(buf);
+        CredentialStore s2 = CredentialStore.readFrom(buf.toSource());
+
+        assertTrue(s2.isAccessDocumentVerified(),
+                   "verified flag must survive serialize/deserialize round-trip");
+    }
+
     /**
      * Forges a payload with a bogus FIELD_VERSION byte and asserts that
      * {@link CredentialStore#readFrom} rejects it with
@@ -91,7 +105,7 @@ class CredentialStoreSerializationTest {
     @Test
     void readFromRejectsWrongFieldVersion() {
         RecordingSink buf = new RecordingSink();
-        buf.write((byte) 0x7F); // != FIELD_VERSION (== 1)
+        buf.write((byte) 0x7F); // != FIELD_VERSION
 
         ISOException ex = assertThrows(ISOException.class,
             () -> CredentialStore.readFrom(buf.toSource()));