feat: allow null dpop_jkt binding for direct authorization

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

src/pds.js

···
       return errorResponse('invalid_grant', 'Invalid code', 400);
     if (authRequest.client_id !== clientId)
       return errorResponse('invalid_grant', 'Client mismatch', 400);
-    if (authRequest.dpop_jkt !== dpop.jkt)
+    // For PAR flow, dpop_jkt is set at PAR time and must match
+    // For direct authorization, dpop_jkt is null and we bind to the token request's DPoP
+    if (authRequest.dpop_jkt !== null && authRequest.dpop_jkt !== dpop.jkt) {
       return errorResponse('invalid_dpop_proof', 'DPoP key mismatch', 400);
+    }
 
     const parameters = JSON.parse(
       /** @type {string} */ (authRequest.parameters),