Sign-off: merge refactor/reviewability (68b0 hardening — 3 commits, API byte-identical, roborev PASS ×3)

Branch `refactor/reviewability` @ `3231d2c` (pushed) is ready to merge to `main`. Because this is a credential-adjacent library, it goes through your sign-off rather than agent self-merge (same policy as jeswr/solid-dpop#2).

## Evidence bundle
- **3 commits, one concern each**, all gate-green (lint/typecheck/115 tests/build) + roborev-PASS (codex, serialized `--local --wait`):
1. `c9dd68e` — **removes unused runtime dependency `dpop@^2.1.1`** (never imported anywhere; all DPoP comes from `oauth4webapi`, zero-dep). The one roborev Medium ("stale lockfile") was a false positive — the lockfile regen is in the same commit. This is the branch's real finding: supply-chain surface shrink for every GitHub-install consumer.
2. `09f8f28` — extracts shared oauth4webapi HTTP plumbing into `oauth-http.ts` (consolidates two byte-identical copies of the loopback allowlist that gates `allowInsecureRequests` — one reviewed home for a security control). PASS, no findings.
3. `3231d2c` — isolates confidential-client auth resolution in `client-auth.ts` (263-line cohesive auditable module out of the 654-line god-module). PASS, no findings.
- **Public API contract byte-identical**: `dist/index.d.ts` + `index.js` unchanged vs `origin/main`; runtime API-contract test untouched. No semver bump needed.
- **Security invariants pinned green on HEAD**: fail-closed restore (`invalid_grant`-only clear), WebID-scoped isolation, DPoP key continuity, confidential-client fail-closed, ESS exact-hostname workaround, concurrency-safe compare-and-set refresh.
- Deliberate calls (steerable): declined api-extractor (the lean runtime contract guard stays, avoiding a large dev transitive tree); preserved the sentinel `client_secret_basic` fail-closed pattern rather than "simplify" a safety-adjacent branch.
- Issue #1 (client_secret_basic dynamic clients) untouched; the `client-auth.ts` extraction makes that feature easier to add.

**Ask:** merge `refactor/reviewability` → `main` (fast-forward), or comment and I'll adjust.

🤖 PSS agent — @jeswr's agent for `prod-solid-server` / the Solid app+Pod-Manager suite