Add KB JWT signature verification and fix PAR

[frostevent]

Summary

• Verify the SD-JWT-VC's Key Binding JWT against cnf.jwk when present, using the same @owf/crypto alg registry as the issuer-signing check. Throws if a KB JWT is present but no nonce is supplied.
• Fix PAR (RFC 9126): send authorization params in the application/x-www-form-urlencoded POST body instead of the query string, then build a navigable /authorize?client_id=…&request_uri=… URL from the returned request_uri.
• CLAUDE.md: tighten release flow (gh release create --target SHA), drop WALLET ticket references.

Test plan

• yarn check-all (format, lint, typecheck, publint)
• End-to-end smoke against staging: SD-JWT-VC with a KB JWT verifies; tampered KB JWT or wrong nonce is rejected
• End-to-end smoke against staging: PAR-enabled client returns a /authorize?…&request_uri=… URL that completes the flow

🤖 Generated with Claude Code