🛡 Add C2PA Content Credentials verification

[mrtomdev]

C2PA is the cross-industry standard for cryptographic content provenance, now used by Adobe, OpenAI, Microsoft, BBC, and others. Images and videos can ship signed manifests describing whether they were AI-generated, edited, or untouched.

What we want

• Detect a C2PA manifest embedded in an image or fetched alongside it.
• If present, verify the signature and surface the claimed provenance in the badge popover.
• If the manifest claims AI generation, flag automatically.

References

• https://c2pa.org/specifications/specifications/1.4/specs/C2PA_Specification.html
• https://github.com/contentauth/c2pa-js (JS verifier — possibly bundleable)

Medium-large task. Open to discussion on whether to use the official lib or a minimal verifier.