4.9 Add local verification tests for trusted-session invitations

[marwannettour]

Parent epic: #310

Summary

Cover decryption, signature verification, identity validation, expiration, replay protection, and grant decisions.

Requirements

• Test a valid invitation.
• Test an expired invitation.
• Test an invitation signed by a non-trusted client.
• Test an invalid signature.
• Test an invitation addressed to another client.
• Test replay with the same nonce.
• Test missing, expired, and revoked grants.

Acceptance criteria

• Tests use FluentAssertions.
• Tests cover both validation success and rejection reasons.