testing/cross_backend/session_cookie_codec.ts

Cross-backend parity suite for the signed session cookie codec over real HTTP: which spellings of a correctly signed cookie each spine accepts.

The cookie is ${token}:${expires_at}.${signature}, the signature the padded standard base64 of an HMAC-SHA256 MAC. Both spines must accept exactly one spelling of a given signed payload, or a cookie that one spine refuses would authenticate on the other. The suite holds the test keyring, so it signs payloads itself and sends variants a lenient decoder would take:

• signature spelling — the last data character bumped so the trailing bits are non-zero (atob decodes the same MAC), and the = padding dropped. Both must be refused.
• expires_at spelling — +N, N, N.0, and an all-digit value past u64::MAX (the Rust spine parses it as u64), each signed with the real key. All must be refused. A leading-zero 0N reads as N on both, so it still authenticates — the bound is on the value, not the digit count.

The positive controls run first: re-signing the keeper cookie's payload reproduces the cookie byte for byte (the suite's keyring is the backend's), and that cookie authenticates. Authentication is probed with the account_verify RPC action. The per-impl unit tests cover each codec directly; this suite is what catches the two drifting apart.