[codex] fix: guard DPoP fallback URL construction

[StiensWout]

Summary

• Guard DPoP fallback request URL construction so malformed Host or request URL values return null instead of throwing.
• Convert an unnormalizable DPoP request URL into an invalid-credentials auth failure before proof verification.

Root cause

requestAbsoluteUrl caught invalid absolute originalUrl parsing, then built a fallback URL from originalUrl and Host without guarding that second new URL(...) call.

Impact

Malformed Host values during DPoP auth now fail as ServerAuthInvalidCredentialError with Invalid DPoP request URL. instead of surfacing as a defect. Valid absolute URLs and existing relative URL fallback behavior are preserved.

Validation

• PATH="$HOME/.vite-plus/bin:$PATH" vp test apps/server/src/auth/dpop.test.ts
• PATH="$HOME/.vite-plus/bin:$PATH" vp check
• PATH="$HOME/.vite-plus/bin:$PATH" vp run typecheck