feat: migrate Credo 0.5 to 0.7

[jrhender]

Summary

Fourth of five stacked PRs for #57 (stacked on #60) — the headline item.

Upgrades @credo-ts/{core,askar,node} 0.5.10 → 0.7.0 and replaces the @hyperledger/aries-askar bindings with @openwallet-foundation/askar 0.6 (koffi-based — no more ffi-napi/ref-napi compilation). Node 22 → 24 everywhere, which the new bindings support and which Jest needs to require() the now ESM-only Credo packages.

Code migration (Credo 0.6/0.7 breaking changes)

• CredoService: walletConfig moved from the agent InitConfig to the AskarModule store config; the separate raw AskarWallet + SigningProviderRegistry are gone. A withAskarSession() helper (via AskarStoreManager) replaces the raw wallet accessor; autoUpdateStorageOnStartup migrates pre-0.6 stores.
• KeyService: agent.wallet.createKey → the new KMS API. Keys are imported with an explicit kid so the REST keyId contract (base58 of the public key) is unchanged. Private-key export (GET /key/:keyId) is intentionally absent from the KMS API and now reads through a raw Askar session (keeps the documented export/import portability flow). Fixes a latent bug where secp256k1 keys were stored as mislabelled Ed25519 keys; they are now proper EC JWKs, unblocking did:ethr generation.
• DIDKeyFactory: dids.create takes a KMS keyId (the Key/Ed25519Jwk classes are gone). Duplicate DID creation now throws on the DidRecord, so the factory returns the existing document — the seeder re-registers its DIDs on every boot (restart-with-same-wallet verified).
• CredentialsService: proofPurpose must be a jsonld-signatures purpose instance instead of a string.
• TypedArrayEncoder.fromBase64 is strict in 0.7 (no unpadded/url-safe input) — JWK fields now decode via fromBase64Url/Buffer.

Load-bearing constraints (commented in code)

• @openwallet-foundation/askar-nodejs must be imported before any @credo-ts/* package — it registers the native binding that the ESM-only Credo packages snapshot at load time.
• Jest runs with NODE_OPTIONS=--experimental-vm-modules; jest-setup/preload.cjs loads the askar packages once per worker (koffi type registration is process-global) and moduleNameMapper shims hand the singletons to each test registry; webcrypto-core is pinned to its CJS build to avoid concurrent dual-format loading.
• The @credo-ts/core patch is re-created against 0.7: signing a DIDAuth presentation (no verifiableCredential) still fails class validation (Make verifiableCredential property on W3cPresentation optional openwallet-foundation/credo-ts#2038).

Verification

• All unit suites (69 tests), the did library suite (incl. a new idempotency test), the e2e project and the app e2e suite pass (the 4 Resident Card tests need w3id.org access — CI covers them)
• node:24 Docker image builds and runs; manual smoke: boot + seeding, DID create, key export round-trip (private JWK), credential issuance, wallet reuse across restarts

Part of #57

🤖 Generated with Claude Code