Claim verify API

POST /api/v1/kya/claims/verify with a compact RS256 token. Results: valid, expired, revoked, or bad signature. Marked Pro+ on /pricing.

Issue: GET .../passport?signed=1 and GET .../sessions/{id}/claim. Kinds: shield-kya-agent-passport-v2, shield-kya-session-claim-v1.