ALLOW_BEARER_FALLBACK

Use DPoP when the issuer advertises it (dpop_signing_alg_values_supported in its /.well-known/oauth-authorization-server); otherwise downgrade to a Bearer token for that issuer only. ⚠️ While downgraded, a leaked access token is not sender-constrained: anyone who obtains it can redeem it. Switches back to DPoP automatically once the issuer advertises it.