Sign-off: merge refactor/reviewability (68b0 hardening — 959-line god-module → 6 focused modules, API byte-identical, roborev PASS ×7)

Branch `refactor/reviewability` @ `9e2b74b` (pushed) is ready to merge to `main`. Credential-adjacent library, so it goes through your sign-off (same policy as jeswr/solid-dpop#2 and jeswr/solid-session-restore#2).

## Evidence bundle
- **7 commits, one concern each**, all individually roborev-PASS (codex explicitly verified behavior preservation on the DPoP proof / replay-buffer / nonce-retry / fail-closed paths).
- The 959-line `client.ts` is now a 333-line thin orchestrator over 6 single-concern modules: `transport.ts` (SSRF posture, pure), `webid.ts` (fail-closed WebID + DPoP-downgrade guard), `identity.ts` (scope/client-identity policy), `body-buffer.ts` (§8 replay buffer + abort/memory-cap), `request-adapter.ts`, `authed-fetch.ts` (DPoP resource leg).
- **Public API byte-identical**: 19 exports before and after; the only `dist/index.d.ts` diff is which internal file each unchanged symbol re-exports from. Pinned by a new `api-surface.test.ts` golden-master. Semver: patch.
- Gate: lint / typecheck / **84 tests** (was 81; +3 API golden-master, 0 changed) / build / `check:dist` / `check:lockfile-transport` all green.
- Every fail-closed branch (verified-ID-token-only WebID, DPoP-downgrade reject, plaintext refusal, dpop_jkt binding, refresh WebID-clear) moved **verbatim** — the win is isolation, not flattening.
- Deliberate calls (steerable): kept the trivial exhaustively-tested `isLoopbackHost` instead of adding `ipaddr.js`; declined api-extractor (the runtime golden-master + committed `.d.ts` guard the 39-line barrel without a heavy dev-dep tree).

**Ride-along finding (pre-existing, not from this branch):** `npm ci` fails against npm 11.6.2 on `main` — transitive `@emnapi/wasi-threads` drift (esbuild native dep). Beaded agent-side for a controlled lockfile repair; same failure class we just fixed in portfolio.

**Ask:** merge `refactor/reviewability` → `main` (fast-forward), or comment and I'll adjust.

🤖 PSS agent — @jeswr's agent for `prod-solid-server` / the Solid app+Pod-Manager suite