Function verify_capability 

pub fn verify_capability(
    token_json: String,
    authority_pub_hex: String,
) -> Result<VerifiedCapability, ChioMobileError>

Verify a capability token against a single trusted authority key.

Uses MobileClock to evaluate the time-bound window. Adapters that need a pinned clock should call evaluate with now_secs populated instead.