fix(auth): realign vti-didcomm-js REST auth to the current VTA wire contract (D8-F2)

[stormer78]

What

src/vta-rest-auth.js was speaking a wire contract the VTA hasn't emitted or
accepted in months, so REST authentication via this library could not succeed
against a current VTA at all (D8-F2 in the networking-remediation plan).

Two independent drifts, both verified against vta-service/src/routes/auth.rs
and the generated vta-sdk::protocols::auth types:

Was (broken)	Now (current server)
message type https://affinidi.com/atm/1.0/authenticate	https://trusttasks.org/spec/auth/authenticate/0.1
message type .../atm/1.0/authenticate/refresh	https://trusttasks.org/spec/auth/refresh/0.1
challenge parse { sessionId, data: { challenge } }	flat ChallengeResponse { challenge, sessionId, expiresAt }
token parse { data: { accessToken, accessExpiresAt, … } }	AuthenticateResponse { session, tokens }

The legacy message-type aliases were explicitly removed server-side (auth.rs:179
/ auth.rs:350 reject anything else); the Message.typ the VTA checks maps from
the DIDComm plaintext type field (#[serde(rename = "type")]), which is what
these constants set.

Relative → absolute lifetimes

The current TokenBundle carries OAuth 2.0-style relative lifetimes
(expiresIn / refreshExpiresIn, seconds from issuance), not absolute
timestamps. The library now converts them to absolute Unix-second
accessExpiresAt / refreshExpiresAt against session.issuedAt — mirroring the
Rust AuthenticateResponse::{access,refresh}_expires_at_epoch helpers — so the
public authenticate() / refresh() return contract is unchanged.

Deliberately unchanged

The challenge request still sends { did }: the current ChallengeRequest
accepts it as a one-release deserialize alias of the canonical subject, so
{ did } works against both current and not-yet-upgraded VTAs. A comment notes
subject is canonical for when the alias is removed.

Tests

• test/vta-rest-auth.test.js updated to the current wire shapes (flat
  challenge, { session, tokens }, new message types, relative→absolute expiry
  assertions).
• Full suite: 194 pass, 11 skipped (the roundtrip-rust vectors that need
  the pre-built Rust helper), 0 fail. npm run build:types clean.

Version

0.6.0 → 0.6.1 (patch — fixes a broken path to match the server). Also corrects
the package-lock.json version field, stale at 0.2.0 since before 0.4.

Part of D8 (browser / JS-client interop). This is R3.6 (verify message
type + shape against the current Rust server) applied to the auth path.