test(08-02): add failing RFC 7591 registration RED test in wristband

- TestPhase8RedRegistration asserts the exact public-client DCR success
  contract and fails while Server.Register is a 501 stub
- adds the Backend/Tx transaction-scoped store bundle (ClientStore,
  AuthCodeStore, RefreshTokenStore, AccessTokenIssuer) and wristband's own
  in-memory implementation for framework-level tests (D-07)
- adds crypto.go's fixed-transform helpers (random base64url, sha256 hex,
  constant-time compare, S256) and Options/Server seams for the DCR
  lifetimes, cap, sweep age and 64 KiB body bound (D-03/D-21)

wristband/register.go

@@ -0,0 +1,13 @@
+// RFC 7591 Dynamic Client Registration (08-02-PLAN.md Task 2, D-02/D-05/
+// D-06/D-21). This is the Phase 8 Wave 2 RED placeholder: Register returns
+// 501 so TestPhase8RedRegistration fails with the PHASE8_RED:registration
+// sentinel while scripts/check-phase8-red.sh verifies the failure is
+// fail-closed, matching the 08-01-PLAN.md Task 1 RED/GREEN pattern.
+package wristband
+
+import "net/http"
+
+// Register handles POST /oauth/mcp/register.
+func (s *Server) Register(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusNotImplemented)
+}