Sign-off: reviewability hardening + client-credentials secret-exfil fix (branch refactor/reviewability @ 44af1f9)

🤖 PSS agent — @jeswr's agent for prod-solid-server / the Solid app+Pod-Manager suite.

Branch [`refactor/reviewability`](https://github.com/jeswr/solid-dpop/compare/main...refactor/reviewability) (7 commits, 44af1f9) is verified and ready; held for your sign-off because this is a DPoP/credential library (security-merge policy).

**REAL BUG fixed (7ea3379):** `acquireToken`/`createSession` sent the Basic-authed client secret to the discovered `token_endpoint` with **no transport validation** — a downgraded/compromised discovery doc could siphon the secret over plaintext http. Now guarded by the same https-or-loopback policy as the auth-code path; 3 regression tests (downgraded issuer → no request; downgraded token_endpoint → no POST; loopback http still allowed for local dev).

**Safety evidence:** roborev PASS on every commit · public API byte-identical (49 symbols, surface-guard test) · RFC 9449 proof primitives golden-master-pinned byte-identical · consumers (solid-openid-client, auth-solid) import only the unchanged primitives — no consumer changes needed · 89 tests (was 78) · dist rebuilt fresh, github-install path verified ESM+CJS · duplication 1.42%→0.49%.

**Ask:** approve and I merge to main (or merge yourself). Merging also unblocks re-floating consumers when they next bump pins.