Sign-off: merge feat/cnf-x5t-s256 — RFC 8705 cert-bound-token confirmation (auth-perf Tier-1a)

Branch `feat/cnf-x5t-s256` @ `67108b5` (pushed, 2 commits) adds `cnf.x5t#S256` certificate-bound-token confirmation to the verifier — the blocking prerequisite for the high-throughput auth Tier-1 (RFC 8705 mTLS-bound tokens; design in `solid-server-rs/docs/design/high-throughput-pop-auth.md`). Credential-verification code → sign-off-gated.

## Why
The authed path is bottlenecked on per-request ES256 (~50% CPU; the design doc's measured floor). RFC 8705 moves PoP to the TLS layer — verified once per connection, a 32-byte thumbprint compare per request. This is the verifier primitive that makes it possible; the TLS/acceptor wiring is a separate solid-server-rs change (Tier-1b).

## What
- **`Confirmation { Jkt(String), X5tS256(String) }`** enum; `VerifiedToken.cnf_jkt` field → `confirmation: Option` (with back-compat `cnf_jkt()`/`cert_x5t_s256()` accessors).
- **`AuthRequest.client_cert_x5t_s256: Option`** — the host passes in `base64url(SHA-256(DER(cert)))`; **no TLS code enters the crate** (stays issuer-agnostic, no new deps — base64url + existing sha2).
- Dispatch on the **token's** confirmation method, never the presentation scheme. **Constant-time** compare. `cnf["x5t#S256"]` must be a 32-byte base64url thumbprint (RFC 8705 §3.1); a both-`cnf` token is rejected as ambiguous; present-but-malformed `cnf` → reject (not treated as absent).

## Fail-closed matrix (verified)
cert-bound+matching → accept · cert-bound+no-cert → reject · wrong/truncated/extended/bit-flipped cert → reject · **no downgrade either direction** (cert-bound-via-DPoP-proof → reject; DPoP-via-cert → reject; DPoP+cert-equals-jkt → still reject) · both-cnf → reject · malformed x5t → reject · DPoP happy path unchanged · cert-bound signature still verified.

## Evidence
- Gate: `cargo fmt --check` + `cargo clippy -D warnings` + `cargo test --all-features` → **245 passed / 0 failed**. **ES512 feature paths confirmed unaffected** (11 P-521 tests pass under `--all-features`).
- roborev: first review 2 Mediums (the fail-closed downgrade paths) + 1 Low → **fixed** in `67108b5`; re-review "No issues found"; a **whole-branch `--type security` review** (both commits vs main, avoiding the diff-scoped trap) → **No issues found**.

**Ask:** merge `feat/cnf-x5t-s256` → `main`. Unblocks solid-server-rs Tier-1b (optional-client-cert rustls + per-connection `ConnPop` thumbprint + auth dispatch).

🤖 PSS agent — @jeswr's agent for `prod-solid-server` / the Solid app+Pod-Manager suite