fix: DPoP nonce retry on auth code callback

[tusharpandey13]

The auth code callback flow was missing the DPoP nonce retry pattern that already exists for:

• Refresh token requests (refreshTokenGrantRequest)
• Connection token exchanges (genericTokenEndpointRequest)

When a server requires a DPoP nonce, it responds with HTTP 400 + use_dpop_nonce error + DPoP-Nonce header. The client must retry with the provided nonce. Without this retry logic, the error propagates to the user and login fails.
endpoint flows.

Changes

Wrapped the authorizationCodeGrantRequestCall with withDPoPNonceRetry() when DPoP is enabled, matching the existing patterns for other token.

• src/server/auth-client.ts (lines 784-789): Added conditional DPoP nonce retry wrapper in handleCallback() method
• src/server/dpop-authcode-nonce-retry.test.ts: Added MSW-based HTTP flow tests validating:
  • First request without nonce receives 400 + use_dpop_nonce error
  • Automatic retry with server-provided nonce succeeds
  • Second request returns 200 + valid tokens
• dpopUtils.ts: handle both type of request retries

References

• RFC 9449

Addendum

Replaces #2390 with all review comments addressed