[AadarshM07]

Summary

Addresses security and code hygiene gaps in CIMD registration and token verification:

• Deny on Host Mismatch: apply_cimd_to_registration_body now raises CimdValidationError on host mismatch instead of returning the document with _cimd_host_matches_request: False.
• Strict Outbound Socket Peer: cimd_peer_is_acceptable requires the outbound socket peer to equal the pinned IP (TRUSTED_PROXIES exception removed for outbound fetch).
• Remove Duplicate Functions: Deleted the duplicate copy-paste definitions of looks_like_cimd_url and resolve_cimd_sync in nitrostack/auth/cimd.py.
• Fix Token Verification Handling: verify_bearer_payload catches ValueError from token verification only; DI resolution errors now propagate rather than silently falling back to anonymous.

---

Testing

• Updated tests/test_mcp20_oauth_cimd.py for host mismatch rejection, outbound socket peer checks, helper count validation, and bearer verification error handling.
• Verified test suite:

Closes #26