DPoPNonceCache

Thread-safe in-memory nonce cache for DPoP proof JWTs.

RFC 9449 §8 allows the AS/RS to supply a DPoP-Nonce response header. The client must echo that value in the nonce claim of its next DPoP proof for the same endpoint. This cache is keyed by (credentialsIdentifier, host) so that the AS nonce (login host) and RS nonce (instance host) never overwrite each other. This matches the per-host isolation used by the iOS implementation, while also ensuring per-user isolation consistent with DPoPKeyManager.