feat(verify): show clear, actionable error for invalid verification links (#299)

[CodingBabe-1]

What does this PR do?

Fixes #299: the /verify page now shows a clear, actionable error whenever a verification link's params are invalid, instead of a blank page, a stuck spinner, or a silent proceed.

The verify page consumed return_url, claim, and threshold / restricted params without validating them. A link with an unknown claim type silently dropped the lock and kept going, a malformed threshold could flow into issuance as garbage, and a missing return_url was silently accepted. This PR introduces a dedicated lib/verifyParams.ts validation module that parses every verification-link parameter and, on failure, returns a specific VerifyError describing exactly what is wrong. The page renders a VerifyLinkError screen that names the problem and offers a clear way back.

What changed

• lib/verifyParams.ts (new) – Pure, testable parsing/validation of /verify query params. Distinguishes a plain self-service visit (nav/sidebar/CTA "Get verified", or a Persona ?inquiry-id resume) from a protocol verification link, and validates the protocol-link case:
  • missing return_url → missing_return_url
  • malformed / insecure return_url → bad_return_url
  • unknown claim type → bad_claim
  • malformed numeric threshold (threshold_years / threshold / min_threshold) → bad_threshold
  • malformed restricted country-code list → bad_restricted
  • Normalises claimParams so only params that apply to the requested claim are carried into issuance.
• app/verify/page.tsx – Calls parseVerifyParams up front; on any failure it renders the dedicated error screen and skips the form entirely (no silent proceed). Also enriches the wallet-not-connected state (tells the user which claim / returning domain is requested) and gives the Persona-resume path a clear "nothing to resume" state instead of a silent dead end.
• app/verify/VerifyLinkError.tsx (new) – Standalone invalid-link error component (title, detail, "Go to your credentials" + "Back home").
• Tests – lib/verifyParams.test.ts drives each malformed param through the validator and asserts the mapped error; app/verify/VerifyLinkError.test.tsx renders the error UI for every error code and asserts the exit points.
• Test tooling – Adds a frontend vitest setup (vitest.config.ts, test/setup.ts, and a pnpm test script) so the app suite can run; the standalone @stellarcred/issuer package keeps its own node-environment runner.

Acceptance checklist

• Every invalid verify link shows an actionable error screen (bad claim / bad threshold / missing return URL / bad return URL / bad restricted). No blank pages, stuck spinners, or silent proceeds.
• Persona resume path and wallet-not-connected path have clear states rather than dead ends.
• Tests render / drive each malformed param through to the error UI.
• Self-service /verify (no params) behaves exactly as before.

Type of change

• Bug fix
• New feature / credential type
• Refactor / cleanup
• Docs
• CI / tooling

Checklist

• cargo test passes (contracts) — no contract changes
• pnpm tsc --noEmit passes (frontend)
• pnpm build passes (frontend)
• pnpm test passes (frontend – includes issuer suite)
• Circuit changes: none
• No NEXT_PUBLIC_ prefix on server-only env vars
• No identity fields stored or logged after KYC provider call

Notes for reviewers

• A plain /verify visit (sidebar, homepage CTAs, "Get a credential") is intentionally not treated as invalid — only links carrying verification params (return_url / claim / thresholds / restricted) are validated strictly. Persona resume links (?inquiry-id=…) are also treated as self-service, as before.
• The error UI is extracted into its own component so it is independently testable and reusable.

[drips-wave]

@CodingBabe-1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits