Refine shared DPoP verifier Effect patterns

[cursor]

What Changed

• Centralized DPoP HTU normalization behind an Option-first helper in dpopCommon, while preserving the existing nullable compatibility wrapper.
• Reworked shared DPoP compact JWT decoding to use Schema.fromJsonString decoders instead of JSON.parse plus manual record traversal.
• Added structured Schema.TaggedErrorClass rejection types to DPoP verification results while keeping the existing reason string for current call sites.
• Updated shared DPoP tests to use @effect/vitest assert and assert typed rejection tags.

Why

This makes the verifier more idiomatic Effect and easier to test/extend: parsing is schema-driven, optional values use Option internally, and rejection cases are granular structured values rather than only strings.

UI Changes

None.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Validation:

• pnpm test src/dpop.test.ts from packages/shared passed (5 tests)
• pnpm exec vp check passed
• pnpm exec vp run typecheck passed

  

Note

Add typed error classes and structured failure results to verifyDpopProof

• Refactors dpop.ts to return a typed DpopVerificationError (with a discriminating _tag) alongside the existing reason string on all failure paths, covering missing proof, malformed JWT, header/payload validation, thumbprint/method/URL/access-token-hash mismatches, time window violations, and signature failures.
• Adds DpopJwtHeader and DpopJwtPayload Schema definitions and Option-returning decode helpers to replace ad-hoc parsing; replaces the throwing publicKeyBytesFromJwk with publicKeyBytesFromJwkOption so malformed JWK coordinates produce a structured error instead of throwing.
• Extracts normalizeDpopHtuOption into dpopCommon.ts and re-exports it from dpop.ts; normalizeDpopHtu now delegates to it.
• Updates tests in dpop.test.ts to assert specific error _tag values using new assertAccepted/assertRejected helpers.
• Behavioral Change: callers of verifyDpopProof now receive an error field on the failure result; the success path is unchanged.

^{Macroscope summarized b948600.}