fix: update atproto fork and fix confidential client tests (#580)

- update atproto fork to include aud claim fix (dfbaf00)
- client assertion JWT now uses issuer (not token endpoint) as aud claim
- this fixes "unexpected aud claim value" errors with confidential clients
- fix tests to explicitly mock OAUTH_JWK setting
- tests were relying on env not having OAUTH_JWK set, but dev env has it

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <[e-mail]>

backend/tests/test_auth.py

···
 
 def test_is_confidential_client_false_by_default():
     """verify is_confidential_client returns False when OAUTH_JWK not set."""
-    # tests run without OAUTH_JWK configured
-    assert is_confidential_client() is False
+    with patch("backend._internal.auth.settings.atproto.oauth_jwk", None):
+        assert is_confidential_client() is False
 
 
 def test_is_confidential_client_true_when_configured():
···
 
 def test_get_public_jwks_returns_none_without_config():
     """verify get_public_jwks returns None when OAUTH_JWK not configured."""
-    # tests run without OAUTH_JWK configured
-    assert get_public_jwks() is None
+    with patch("backend._internal.auth.settings.atproto.oauth_jwk", None):
+        assert get_public_jwks() is None
 
 
 def test_get_public_jwks_returns_public_key():
···
         encryption_algorithm=serialization.NoEncryption(),
     )
     key_obj = jose_jwk.construct(pem_bytes, algorithm="ES256")
-    test_jwk = json.dumps(key_obj.to_dict())
+    jwk_dict = key_obj.to_dict()
+    jwk_dict["kid"] = "test-key-id"  # add kid to test preservation
+    test_jwk = json.dumps(jwk_dict)
 
     with patch("backend._internal.auth.settings.atproto.oauth_jwk", test_jwk):
         jwks = get_public_jwks()
···
         assert public_key["kty"] == "EC"
         assert public_key["alg"] == "ES256"
         assert public_key["use"] == "sig"
+        # should preserve kid from original JWK
+        assert public_key["kid"] == "test-key-id"

backend/uv.lock

···
 
 [[package]]
 name = "atproto"
-version = "0.0.1.dev461"
-source = { git = "https://github.com/zzstoatzz/atproto?rev=main#57bb99a28c916a5b5c960ade00e4f82695860af1" }
+version = "0.0.1.dev469"
+source = { git = "https://github.com/zzstoatzz/atproto?rev=main#dfbaf0002fed21d5a0ca28a6219e2b6b42384259" }
 dependencies = [
     { name = "click" },
     { name = "cryptography" },