feat(DPoP): add API test

tests/common/server.env

@@ -145,3 +145,14 @@ OXICLOUD_AUTH_OPAQUE_KSF_MEMORY_KIB=8
 OXICLOUD_AUTH_OPAQUE_KSF_ITERATIONS=1
 OXICLOUD_AUTH_OPAQUE_KSF_PARALLELISM=1
 
+# DPoP (RFC 9449) — required mode surfaces every verifier /
+# nonce / replay bug as a hard 401 (opportunistic would swallow
+# some cases as warnings). Safe today because unbound sessions —
+# `session.dpop_jkt IS NULL`, which is where the test admin's
+# legacy-login lands — are still exempted at the middleware; the
+# session-level enforcement flip is Gate 9. Once that arrives,
+# every bind-time downgrade path also gets caught here without
+# a config change. `dpop-hurl-helper` needs this on or the
+# middleware is a pass-through and its scenarios all silently 200.
+OXICLOUD_DPOP_MODE=required
+