Add a Home Key access token provider

[Mathieu2301]

Summary

• add a server-side Home Key provider for the RFC 0004 access-token exchange
• enforce a closed, bounded, no-store response boundary and redact credential-bearing failures
• verify initial authentication and scheduled REAUTH through the real coordinator loop
• document the trusted-backend setup and export the provider from the public package

Validation

• bun run check
• 83 Bun tests
• TypeScript typecheck and production build
• Node.js package smoke test
• canonical coordinator contract suite
• npm package dry run