Credential renewal workflow: allow re-issuing a credential before expiry without revoking

[leocagli]

Context

PR#115 (pending) adds credential expiration tracking. A natural follow-up: before a credential expires, its holder should be able to renew it (extend the expiry) without a full revoke + re-issue cycle. This preserves the credential ID and history.

What to implement

Route: POST /api/protocol/passport/[id]/credentials/[credId]/renew

Request body: { expiresAt: number } — must be in the future and beyond the current expiry.

Validation

• Cannot renew an already-expired credential → 400 with 'credential_already_expired'
• Cannot renew a revoked credential → 400
• New expiresAt must be at least 1 day from now → 400 if too soon
• Admin-only: only an admin or the issuer can renew

Post-renewal

• Update expiresAt in place (same credential ID)
• Audit log entry (issue Admin audit log: record every admin action (grant, revoke, transfer) with actor and timestamp #108): action 'credential_renewed', old/new expiry in metadata
• Webhook: credential.renewed event with { credentialId, oldExpiresAt, newExpiresAt }

Acceptance criteria

• POST with future expiresAt → credential.expiresAt updated
• Renewing already-expired → 400
• New expiresAt < now + 1 day → 400
• Audit log and webhook fire
• Unit test: renew active → new expiry; renew expired → 400

🎁 Evidencia visual = reward extra

• Si tu PR incluye video demo o capturas de pantalla mostrando la funcionalidad pedida funcionando end-to-end, va a ser considerado para rewards de GrantFox en esta issue. No es obligatorio, pero suma mucho para la evaluación.

[ekwe7]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery