backend phase 6: nurse verification & credentials (mocked vendors)

The trust engine. New `verif` schema (5 tables) + a data-driven verification
pipeline: steps are rows (6 seeded step-types), not a code enum.

- nurse_verifications.status is the single source of verification truth;
  nurse_profiles.is_verified is flipped ONLY inside the finalize transaction
  (VerificationAggregator: tracked verification + tracked profile -> one commit)
  and reversed on suspension/expiry — no in-between state.
- is_automated snapshotted onto each step at submit; steps seeded from active
  required step-types; automated runs (identity-KYC, Shahkar, IBAN ownership)
  find their step by code.
- users.national_id populated only on identity-KYC pass; Shahkar + IBAN owner
  compare against it (money-mule guard); shared-SIM -> shared_sim support alert.
- Documents are metadata-only behind signed URLs; credential_number encrypted
  and never serialized; public trust badge exposes credential TYPES, not numbers;
  holder-name cross-checked against the verified identity before recording.
- Admin-triggered credential-expiry scan reverts lapsed steps, re-gates
  bookability, raises a verification_expired alert + verification_expiry_prompt
  notification (scheduled cron deferred; config key
  verification_expiry_scan_cadence_hours).

Three new mock vendor seams (IShahkarVerifier / IIdentityKycProvider /
ICredentialVerifier) behind DI; reuses b3 IBankAccountOwnershipVerifier and
b0 IObjectStorage/IFieldEncryptor. 15 endpoints across 4 controllers.

Two migrations (tables + step-type seed). 154 tests pass, zero new warnings.
Contract dev/contracts/domains/verification.md + swagger snapshot refreshed;
handoff/report/mocks-registry updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/CONVENTIONS.md

@@ -312,6 +312,26 @@ collide). Persist it (`NVARCHAR(64)`) and back it with a **filtered unique index
 with a handler pre-check for the friendly `409`. Reuse this helper for any future "same set of ids" guard;
 do **not** reuse `IFieldEncryptor.Hash` (that is for PII-column equality lookups).
 
+### Guarded cross-aggregate state flip (backend-phase-6)
+
+When one write must atomically change a header row's state **and** a derived boolean on a *different*
+aggregate (e.g. `nurse_verifications.status` → `nurse_profiles.is_verified`), do it in one transaction:
+load **both** as tracked entities, mutate them through a single pure domain helper
+(`VerificationAggregator.Finalize`), then `CommitAsync` **once** — never flip the derived flag from a
+controller, a partial write, or an out-of-band update, and never leave an in-between state. Two follow-on
+rules this establishes:
+
+- **Self-committing facades come after the atomic commit.** `ISupportAlertService.RaiseAsync`,
+  `INotificationDispatcher.DispatchAsync`, `IAuditLogger.WriteAsync` and `IPlatformConfig.SetConfig` each call
+  `SaveChanges` on the *shared scoped* `DbContext`. Calling one mid-build flushes your partial tracked changes —
+  invoke them only **after** `unitOfWork.CommitAsync()`. In a batch loop that commits per item, load and guard
+  every dependency **before** mutating tracked state, or an early `continue` leaks a dirty entity that a later
+  iteration's commit will flush.
+- **Persist a status enum as its stable snake_case code, not the member name.** Define the C# enum, then map
+  it with a `HasConversion(e => e.ToCode(), s => Parse(s))` value converter (see `VerificationCodes`) so the DB
+  and the wire carry `in_review`, not `InReview`. Enum→code mapping in a projected read happens **in memory
+  after materialization** (`.ToCode()` is not LINQ-translatable); DTOs expose the code string.
+
 ---
 
 ## 7. Validation