authorization-server/dpop: round-6 test polish

Broaden the negotiateProofAlg fallback test to also assert undefined → ES256
and correct its title ("empty array or absent field") — the contract covers
both, though absent is gated upstream in the scenario.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: PieterKas

src/scenarios/authorization-server/dpop.test.ts

@@ -153,8 +153,11 @@ describe('negotiateProofAlg (dpop_signing_alg_values_supported shapes)', () => {
     expect(negotiateProofAlg(['ES256K'])).toBeNull();
   });
 
-  it('falls back to ES256 only for an empty array', () => {
+  it('falls back to ES256 only for an empty array or an absent field', () => {
     expect(negotiateProofAlg([])).toBe('ES256');
+    // Absent never reaches here in the scenario (the support gate SKIPs upstream),
+    // but the contract still treats undefined as the empty/best-effort case.
+    expect(negotiateProofAlg(undefined)).toBe('ES256');
   });
 
   it('returns null for a present-but-non-array (malformed) value (→ SKIP)', () => {