Cardano Updates

Fixes #553 — remove console.log(err) from SDJWT.verify() catch block
Fixes #554 — add temporal claim validation (exp/nbf) per RFC 7519

Changes:
- Check exp claim (§4.1.4): return false if current time >= exp
- Check nbf claim (§4.1.5): return false if current time < nbf
- Remove console.log: empty catch block, consistent with JWT.verify()
- Use string literals for claim keys to keep import type-only
- Remove static temporal fixtures; tests use vi.useFakeTimers()
  to control system clock and build SD-JWT payloads dynamically

Matches the areTimestampsValid() pattern in JWT.verify (#550, #552).
Credentials without exp/nbf keep current behavior (no enforcement).

Signed-off-by: Abhigyan Singh <[email protected]>

Updates the requirements on [thiserror](https://github.com/dtolnay/thiserror) to permit the latest version.
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](https://github.com/dtolnay/thiserror/commits/2.0.18)

---
updated-dependencies:
- dependency-name: thiserror
  dependency-version: 2.0.18
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: iammdzaidalam <[email protected]>

* build(deps): update bech32 requirement from 0.9.1 to 0.11.1

Updates the requirements on [bech32](https://github.com/rust-bitcoin/rust-bech32) to permit the latest version.
- [Changelog](https://github.com/rust-bitcoin/rust-bech32/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-bitcoin/rust-bech32/compare/v0.9.1...bech32-0.11.1)

---
updated-dependencies:
- dependency-name: bech32
  dependency-version: 0.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

* build(deps): update bech32 requirement from 0.9.1 to 0.11.1

Migrates pallas-addresses to the new bech32 0.11 API: Hrp type, generic
checksum (Bech32), and a single DecodeError. Encode path is unreachable
by construction (hardcoded HRPs), so encode_bech32 is now infallible.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Santiago <[email protected]>

Snapshot of input-output-hk/lace-platform @ 994a962152aa6027bd735eb61424fb8334bdbcf2
Produced by open-source-release-publish.yml.

See PROVENANCE for the allowlist hash that controlled this snapshot.

Co-authored-by: lace-publish-bot <[email protected]>

Migrates pallas-addresses to the new bech32 0.11 API: Hrp type, generic
checksum (Bech32), and a single DecodeError. Encode path is unreachable
by construction (hardcoded HRPs), so encode_bech32 is now infallible.

Snapshot of input-output-hk/lace-platform @ 994a962152aa6027bd735eb61424fb8334bdbcf2
Produced by open-source-release-publish.yml.

See PROVENANCE for the allowlist hash that controlled this snapshot.

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: Nicolas Ludueña <[email protected]>

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.0.6 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.0.6...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

Now that the friendly renderer covers Shelley through Babbage, those
tx bodies' update field is no longer just noise — it carries real
governance state (a ProposedPPUpdates map keyed by genesis-key hash and
an EpochNo). Render it directly from the ledger TxBody via
`updateTxBodyL`. Conway replaced update proposals with the new
governance system, so the field is absent (not null) in Conway+.

Adds `updateProposalPairFor` and `renderUpdate` helpers; the
per-era PParamsUpdate is rendered via its ledger ToJSON instance.

friendlyTx and friendlyTxBody now take ShelleyBasedEra era and accept
Exp.SignedTx era / Exp.UnsignedTx (ShelleyLedgerEra era). They are no
longer parameterised by Exp.Era era (which is Conway-only) — the
renderer works for Shelley through Conway tx and tx-body files,
unblocking transaction view for pre-Conway tx files.

friendlyTxBodyImpl reads every field directly from the ledger TxBody
via lenses, so the old API's TxBodyContent constructor and
getTxBodyContent are no longer used in this module.

The body composes a list of pairs from per-feature helpers
(validityRangePair, mintPairFor, collateralInputsPairFor,
requiredSignersPairFor, referenceInputsPairFor, totalCollateralPairFor,
returnCollateralPairFor, alonzoScriptWitnessPairsFor,
conwayBodyPairsFor). Era-gated helpers return [Aeson.Pair] and emit []
in eras that don't have the field, so JSON keys for absent-in-this-era
fields (e.g. "mint" in Shelley, "collateral inputs" in Mary) are
omitted from the output rather than rendered as null. The eon-based
dispatchers (forShelleyBasedEraInEon, AlonzoEraOnwards,
ConwayEraOnwards, ...) are no longer used in this module.

Also adds an Alonzo YAML golden test alongside the existing JSON
golden to cover the YAML output path for that era.

Relies on cardano-api 11.1.0.0 (PR IntersectMBO/cardano-api#1199),
which widened Exp.SignedTx / Exp.UnsignedTx to all Shelley-based eras.

Signed-off-by: yHSJ <[email protected]>

Fix failing cuddle test for Plutus data Constr.