Revoke and reactivate take exactly one addressing form. Alongside the
issuance session's `sessionId` or `credoIssuanceSessionId`, which still act
on every credential the session issued, a request can name:

- `holderDidKey`: every credential issued to that wallet did:key,
  optionally narrowed by `credentialConfigurationId`.
- `uri` + `idx`: the one credential whose `status.status_list` claim
  carries that pair.

Two forms at once, half of `uri` + `idx`, or a configuration filter without
`holderDidKey` return 400 before any bit changes. So does an empty or `null`
filter, since ignoring it would widen the revocation. A `null` addressing
field reads as absent, as the session-only API did.
`GET /credential/issuer/sessions` gains a `?holderDidKey=` filter.

Two Vault KV indexes back the new forms, one key per record so concurrent
writers do not contend: `sessions/issuance/by-holder/<multibase>/<sessionId>`,
written at offer creation, and `status-lists/entries/<listId>/<idx>`, written
at allocation before the session append. Each status entry records its
`credentialConfigurationId`.

A request resolves to the sessions it touches and a rule picking their
entries. setSessionStatus applies the rule to the session's current entries
inside the session CAS, so a credential issued while a holder revocation is
in flight is included. The chosen entries are stored in the durable
`statusChange` intent: a resumed operation replays them, and a request
covering a different set while one is pending returns 409. `revokedAt` /
`revokedReason` are set only when one revocation covers every entry on the
session. A holder spanning several sessions is processed session by session,
not atomically; re-sending the request finishes a partial failure.

revokeBySessionId / reactivateBySessionId are removed; revoke({ sessionId })
runs the same whole-session path. Table-driven tests send request bodies
through the ValidationPipe from main.ts into the real service, covering
each form and the bodies that must fail with 400 or 404.

Fresh installs only: entries allocated before this change carry no
`credentialConfigurationId`, and a narrowed holder request does not match
them.

- Remove Cypress (specs, configs, deps, runner scripts, CI workflow)
- Port all Cypress specs to Playwright; add specs for app load/public
  pages, wallet lock/unlock (wrong password), ARC76 validation, export
  with wrong password, theme/language/settings
- Fix stale selectors in the multisig and Shamir specs
- Add E2E Tests workflow (build + locales + Playwright) on PRs; run unit
  tests on PRs; update CircleCI
- Add mandatory testing policy to CLAUDE.md and copilot instructions

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Closes #176

Co-authored-by: Ludovit Scholtz <ludovit.scholtz@aaaauto.cz>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Closes #176

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>