REQUIRE_DPOP

HAIP-strict: never downgrade. Issuers without DPoP support fail with a clear ISSUANCE error.