✨ Add PruneExpiredCredentials execute message

[ccamel]

Context

Credentials whose VC validity interval has ended no longer need to remain in the authority active credential set.

The contract should provide a bounded pruning operation to remove expired credentials.

Expected behavior

Add a PruneExpiredCredentials execute message.

PruneExpiredCredentials {
    limit: Option<u32>,
}

Only the app authority is allowed to call this message.

The message must remove credentials whose valid_until is present and lower than or equal to the current block time.

Credentials without valid_until must not be pruned.

The operation must be bounded by limit.

Events

The execution must emit an event containing:

action = "prune_expired_credentials"
pruned_count

Each pruned credential should also be emitted with its identifier if practical.

Notes

After pruning, removed credentials must no longer be returned by Credential or Credentials.

[ccamel]

Closing this feature after clarifying the credential lifecycle model.

Expiration is derived from the credential validUntil claim and does not constitute a revocation or another authority act. An expired credential remains an issued credential, but VerifyCredential reports it as invalid for timestamps outside its validity interval.

Removing expired credentials would erase that distinction and turn a temporal property into a destructive lifecycle operation.

Storage cleanup may be reconsidered later as a technical garbage-collection concern, but it should not be exposed as a credential lifecycle feature imho.