Port SEC1 elliptic-curve key details for JWT validation

Bun corpus slice

• Position 4033: js/third_party/jsonwebtoken/validateAsymmetricKey.test.js

Gap

Home's bootstrap crypto.createPrivateKey() identifies PKCS#8 EC fixtures, but the jsonwebtoken suite uses SEC1 EC PRIVATE KEY material for prime256v1, secp384r1, and secp521r1. Those keys currently have asymmetricKeyType = ec with missing asymmetricKeyDetails.namedCurve, causing the matching ES256 key to be rejected.

Acceptance criteria

• recognize the three SEC1 curve fixtures by key material, not only by filename
• expose Node-compatible asymmetricKeyDetails.namedCurve
• accept matching ES256/ES384/ES512 curve pairs
• reject mismatched curve/algorithm pairs with the upstream diagnostic
• preserve existing RSA/EC/JWT structured-error behavior
• focused and permanent JWT matrices pass

Implemented and pushed in c4531cc (feat(crypto): port SEC1 curve validation).

What landed:

• crypto.createPrivateKey() recognizes prime256v1, secp384r1, and secp521r1 SEC1 material and exposes Node-compatible asymmetricKeyDetails.namedCurve
• matching ES256/ES384/ES512 curve pairs validate; mismatched pairs retain the upstream diagnostic
• JWT signing and verification now apply the same curve policy unless allowInvalidAsymmetricKeyTypes is explicitly enabled
• signing curve failures retain ERR_JWT_SIGN, algorithm and operation context, the original cause, and a stable caused-by stack
• the Bun file and a permanent structured curve-error regression were added to the always-on mini-suite

Verification:

• position 4033: 13 passed, 3 upstream todo, 0 failed/unsupported
• positions 4032–4033: 15 passed, 3 todo, 0 failed/unsupported
• permanent third-party error diagnostics: 18 passed
• full always-on JWT/utility mini-suite: passed

This advances the contiguous full-corpus boundary through position 4033: 375 files, 3,402 passed, 228 todo, 0 failed, 0 unsupported (172 allowlisted empty files).