Real-Redis integration spec for the DPoP jti replay store #302

Summary

The DPoP proof replay store (jti reservation) is covered by unit specs against fakes only. Add integration specs that run against a real Redis instance.

Acceptance criteria

• Concurrent reservation of the same jti results in exactly one accepted proof.
• A reserved jti expires after its TTL and can then be reserved again.
• Redis unavailable, a dropped connection, or a clock offset beyond the allowed bound results in "unavailable" and the proof is refused.
• A fresh or emptied store refuses proofs until the warm-up period has elapsed.
• Stored keys carry the configured prefix and never contain the raw jti or tokens.
• Specs run in CI with the run-integration label.

Part of #258. Minor advisories to fold in: skip jti reservation on the insufficient-scope path; timeout on the Redis health lock acquisition; spec for a trailing-slash path prefix.

Status

State: Done
Branch: l113-302-redis-replay-specs (#341, #342)
Scope: Real-Redis integration specs for DPoP jti replay store, plus the three minor advisories listed in the issue
Delivered: Nothing yet.
Remaining: To be confirmed.
Follow-ups: None.