fix: harden payment challenge handling

[brendanjryan]

Summary

• Enforced a 32-byte minimum for server challenge secret keys.
• Capped oversized WWW-Authenticate request parameters before decode and parse.
• Updated docs, examples, fixtures, and release notes for the stricter server secret requirement.

Motivation

Weak HMAC keys reduce challenge ID binding strength, and unbounded auth-param parsing lets oversized headers reach decode and JSON parsing work.

Key design considerations

• Validates both explicit secretKey config and MPP_SECRET_KEY env fallback through the same Mppx.create path.
• Keeps the size cap on the encoded request auth-param so oversized values are rejected before allocation-heavy parsing.
• Leaves low-level challenge HMAC helpers usable for deterministic protocol vectors while enforcing the operational key policy at server construction.

Conformance-PR: tempoxyz/mpp-tools#35

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@562

commit: 454c9e4