quest(auth): block the line on closing the session for a malformed AUTH_OK grant

[kixelated]

Problem

#4277 specified that a malformed or non-canonical grant pattern is a PROTOCOL_VIOLATION (drafts/draft-lcurley-moq-lite.md, Path Pattern), but Rust and JS only drop the token and keep the session up. Maintainer decisions from the 09-28 merged-PR audit: both implementations close the session with PROTOCOL_VIOLATION to match the draft (fail loud), with tests in both languages, before the line lands on main. The maintainer also decided that an out-of-range Expires in AUTH_OK closes the session the same way.

Approach

New child quest Malformed grant on the auth line (finding, decline). Verified still present on the line branch: Rust's PresentToken ends only the token on the decode error, and the JS #run loop in auth_session.ts catches it the same way.

The quest covers:

• A malformed or non-canonical grant pattern closes the session with PROTOCOL_VIOLATION in Rust and JS.
• An out-of-range Expires does the same (decided here). Rust already labels it a ProtocolViolation but only ends the token. The draft does not yet define "out of range", so the quest adds that definition to it.
• Tests in both languages for all three cases (malformed pattern, non-canonical pattern, out-of-range Expires).

Impact

• Quest files only. No API or wire change.

Alternatives

• None considered.

Follow-ups

• None beyond the new quest.

(Written by Opus 5.5)

🤖 Generated with Claude Code