Add end-to-end protocol contract tests with a real HTTP authority stub

[ocularminds]

Context

Transport behavior is currently tested mainly through injected fetch functions. That gives strong unit coverage but does not prove that the public package sends and consumes the complete wire contract correctly through a real HTTP stack.

Acceptance criteria

• Add a bounded loopback test server implementing the Decionis enforce-and-bind and consume-token endpoints used by the package.
• Assert method, path, authorization and idempotency headers, canonical binding fields, evidence forwarding, response limits, and exact grant-consumption payloads.
• Exercise ALLOW, BLOCK, ESCALATE through Presence evidence and re-authorization, grant consumption, and one trusted handler invocation.
• Add negative scenarios for non-2xx responses, malformed JSON, oversized and truncated bodies, binding mismatch, expired grants, delayed responses, and connection termination.
• Run the harness against the packed npm tarball or its public entry point, not private source imports.
• Keep all identities and data synthetic, bound runtime and response sizes, and run the suite in CI with retained diagnostics on failure.