Implement DPoP (RFC 9449) token binding for OAuth access tokens. Features: - DPoP proof verification with ES256 signing - NonceCache for jti-based replay protection - JWK thumbprint calculation per RFC 7638 - Middleware integration with Stop() for clean shutdown - X-Forwarded-Proto support for reverse proxy deployments Security: - DPoP is additional security, never a fallback - Tokens with cnf.jkt require valid DPoP proof - 5-minute proof validity window - Replay attack prevention via jti tracking