shouldAttachDPoP

Decides whether a DPoP proof should be attached to a request for a credential identified by credentialsIdentifier.

An explicit tokenType is authoritative:

• tokenType == "DPoP" → attach.

• any other non-null type (e.g. "Bearer") → do NOT attach, and fast-exit before any KeyStore I/O. This protects the DPoP→Bearer migration / Bearer re-auth path: a Bearer credential that reuses a credentialsIdentifier still holding a stale DPoP key pair must never get an unexpected proof.

A null tokenType is the transient window between /authorize (which mints the key pair before tokenType is written) and /token (which writes tokenType after the key pair has been used to sign the proof); only then do we fall back to the key-material signal.