Enforce Draft-21 bit-width {1, 2, 4, 8} and ZLIB-compressed empty lists

## Objective

Enforce OAuth Status List Draft-21 compliance by restricting bit width strictly to `{1, 2, 4, 8}` and ensuring empty status lists serialize to a valid ZLIB-compressed stream.

## Context

During protocol review against [OAuth Status List Draft-21](https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/):
1. **Bit width overflow:** When a status value >= 256 is supplied, `determine_bits` in `src/domain/models/status_list.rs` calculates `(256+1).next_power_of_two().trailing_zeros() == 9`, causing the token to emit `bits=9`. However, Draft-21 §4.2 explicitly mandates that `bits` MUST be one of `{1, 2, 4, 8}`.
2. **Empty status list representation:** Publishing a list with `statuses: []` produces `lst: ""` (empty string). An empty string is not a valid RFC 1950 ZLIB stream, causing third-party relying party decoders to fail with decompression errors.

## Deliverables

- [ ] In `src/domain/models/status_list.rs`, update `determine_bits` to strictly limit bit width to 1, 2, 4, or 8.
- [ ] Reject status values exceeding 8-bit capacity (values > 255 cannot fit in an 8-bit status list under Draft-21) with a clear validation error (`400 Bad Request`).
- [ ] In `StatusList::create`, when `status_updates` is empty, ensure the status array is encoded through `encode_compressed` so `lst` contains a valid base64url-encoded ZLIB byte stream instead of an empty string.
- [ ] Add tests validating that standard zlib decoders successfully inflate empty status list tokens.
- [ ] Add unit tests verifying `bits` is never emitted as any value outside `{1, 2, 4, 8}`.

## Acceptance Criteria

- [ ] `bits` in generated status list tokens is strictly one of 1, 2, 4, or 8.
- [ ] Empty status list tokens contain a valid, base64url-encoded ZLIB stream that decodes cleanly without error.
- [ ] Conforms to OAuth Status List Draft-21 §4.2 and §4.3.

## References

- `src/domain/models/status_list.rs` (lines 103–107, 180–210)
- `src/utils/bits_validation.rs`
- Arc review: `arc-review/finalReview/application-functional-bugs/README.md` (PoC 2)