enforce v3 verification levels and add health

[soamdesai-tfh]

Summary

• Enforce the requested v3 verification_level instead of silently defaulting to Orb.
• Require a real inclusion proof for the presented credential and keep dummy proofs limited to the explicit invalid-proof test path.
• Forward expected v3 credential failures to the bridge with credential_unavailable and add a simulator /api/health endpoint.

Why

The v3 simulator path could report success when the active identity did not actually have the requested credential proof. The request-level verification_level was ignored in parts of the flow, ModalConfirm reset the presented credential to Orb, and getMerkleProof silently returned dummy proof data when inclusion proof state was missing.

Validation

• ./node_modules/.bin/tsc --noEmit --emitDeclarationOnly false --declaration false
• ./node_modules/.bin/next lint (passes with existing Tailwind classname warnings)
• ./node_modules/.bin/prettier --check src/**
• curl -sS -i http://localhost:3010/api/health returned HTTP/1.1 200 OK with {"ok":true}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldcoin-simulator	Ready	Preview, Comment	Jun 25, 2026 4:55pm

[vercel]

You must have Developer access to commit code to Tools For Humanity on Vercel. If you contact an administrator and receive Developer access, commit again to see your changes.

Learn more: https://vercel.com/docs/accounts/team-members-and-roles/access-roles#team-level-roles