v3.1.1

Two changes to how mockin stands in for a production Person Server.

require_capabilities (new mock switch, default false)

canDriveInteraction treats omitted capabilities as unknown rather than "cannot", and defers anyway. Hellō's Wallet does the opposite — it reaches the person only through a browser the agent opens or an already-open wallet tab, so an agent that declared nothing is unreachable and gets 403 user_unreachable.

That difference was a real test gap: @aauth/proxy 4.0.0 sent no capabilities on the person-token request, passed every suite that mocks a PS, and 403'd against beta Wallet on its first live run. Set require_capabilities: true in any suite that stands in for production.

Default unchanged, so nothing breaks for existing consumers.

A negative token_lifetime still mints an expired auth token (#12)

issueAuthToken clamps the lifetime so an auth token never outlives the presented token (-11 §Auth Token Structure), and floored the result at 1s so a nearly-expired presented token could not produce a negative lifetime. That floor also caught the token_lifetime mock switch when set negative — which is how a resource-side suite mints an already-expired auth token to drive its challenge-on-401 path. It got a token valid for one second instead, and two aauth-proxy component tests failed with a 200 where they expected a 401.

The floor now applies only when the configured lifetime is positive.

233 passing.