Make server callbackUri optional for DC API requests with expectedOrigins

[frostevent]

Summary

signedDcApiRequest with expectedOrigins never reads config.callbackUri, so clients had to configure callbackUri: "" just to satisfy the type checker.

• ServerClientConfig.callbackUri is now optional. The frontend ClientConfig in proof-vc-common still requires it.
• authorizationUrl and signedAuthorizationRequest reject with a clear error when callbackUri is missing.
• signedDcApiRequest rejects when neither expectedOrigins nor callbackUri is provided.
• signedRequest is now async, so signedAuthorizationRequest returns a rejected promise instead of throwing synchronously when its params are invalid.
• README: documents when to use expectedOrigins vs. callbackUri for DC API requests.

Existing clients that pass callbackUri are unaffected.

Tests

• Added: DC API with expectedOrigins and no callbackUri succeeds; DC API with neither is rejected; authorizationUrl / signedAuthorizationRequest without callbackUri are rejected.
• yarn test and yarn check-all pass.

🤖 Generated with Claude Code