fix: escape non-Latin-1 characters in challenge auth-params

[rsproule]

Problem

Challenge.serialize writes the charge description into the WWW-Authenticate header raw. Header values must be ByteStrings (code points ≤ 0xFF), so any description containing an em dash, smart quote, or emoji makes Response construction throw in fetch-compliant runtimes:

TypeError: Cannot convert argument to a ByteString because the character at index 858 has a value of 8212 which is greater than 255.
    at Object.respondChallenge (.../mppx.mjs:6295)

Minimal repro:

const challenge = Challenge.from({
  id: 'abc',
  realm: 'shop.example',
  method: 'stripe',
  intent: 'charge',
  request: { amount: '1400', currency: 'usd' },
  description: '1 × Classmatic — General Admission',
})
new Headers({ 'WWW-Authenticate': Challenge.serialize(challenge) }) // throws

We hit this in production: merchant product titles routinely contain em dashes, so any integrator passing a title through charge({ description }) gets an opaque crash on the challenge response. (Existing serialize/deserialize tests pass because they never place the serialized value into a real Headers/Response.)

Fix

authParam now escapes characters above Latin-1 as \uXXXX inside quoted strings, and the quoted-string parser decodes them. The escape is unambiguous with the existing convention: serializers always double raw backslashes, so a bare \u can only come from this encoding. Older parsers degrade to rendering the literal escape in the display-only description rather than failing.

• Round-trip covered in the existing test.each escape table (em dash, surrogate pairs + quotes).
• New test asserts serialized challenges are constructible as real header values.
• Fuzz suite passes.

🤖 Generated with Claude Code

[brendanjryan]

LGTM!