pub fn verifying_key_from_p256_xy( x_b64: &str, y_b64: &str, ) -> Result<VerifyingKey, DpopError>
Build a P-256 verifying key from JWK x/y (base64url, no padding).