fix(relay-auth): close 5 pre-production security findings (F1–F5)

F1 (HIGH): bind step-up freshness to the required method (stepUpMethod) so a
  login-time or weaker (TOTP) factor can no longer satisfy a passkey requirement.
F2 (HIGH): make the step-up gate host-driven and fail-closed on connect+reattach
  (deny when policy.required and the principal is missing/stale/wrong-method).
F3 (MED): bind the WebAuthn assertion to the stored credential (credentialId
  cross-check + forward publicKey/credentialId to the verifier).
F4 (LOW): make verifyDpopProof totally fail-safe (no unhandled throw), wrap the
  authz boundary into a clean audited 401, and validate cnfJkt format at issue.
F5 (LOW): return newSignCount from finishAuthentication so the caller can persist
  the advanced counter (WebAuthn clone detection).

All fixes ship regression tests. relay-auth: 122 tests green, tsc clean.

relay-auth/src/types.ts

@@ -34,6 +34,7 @@ export interface AuthenticatedPrincipal {
   readonly amr: readonly AuthMethod[] // methods satisfied this session (for step-up, T8)
   readonly authAt: number // epoch seconds of last successful auth (login freshness)
   readonly stepUpAt: number | null // epoch seconds of last step-up (T8 freshness); null = never
+  readonly stepUpMethod?: AuthMethod | null // method used for the LAST step-up (F1 method-binding); absent/null ⇒ none
 }
 
 /**
@@ -44,6 +45,7 @@ export interface AuthenticatedPrincipal {
 export const CAP_TOKEN_SUB_IS_ACCOUNT_ID = true as const
 
 export interface StepUpPolicy {
+  readonly required: boolean
   readonly maxAgeSeconds: number
   readonly requiredMethod: AuthMethod
 }
@@ -141,11 +143,13 @@ export const AuthenticatedPrincipalSchema = z
     amr: z.array(AuthMethodSchema).readonly(),
     authAt: z.number().int().nonnegative(),
     stepUpAt: z.number().int().nonnegative().nullable(),
+    stepUpMethod: AuthMethodSchema.nullable().optional(),
   })
   .strict()
 
 export const StepUpPolicySchema = z
   .object({
+    required: z.boolean(),
     maxAgeSeconds: z.number().int().nonnegative(),
     requiredMethod: AuthMethodSchema,
   })