build: @NullMarked the aauth module (NullAway-clean)

[marcofanti]

Closes the last documented hygiene deferral: the aauth module is now fully @NullMarked (JSpecify), matching aauth-signing. NullAway runs clean on its main sources.

• @NullMarked package-info added to all 8 aauth packages.
• ~100 findings burned down with @Nullable on optional record components, builder fields, exception constructor params/accessors, and nullable helper returns (case-insensitive header lookups, getKeyByKid, cache get, parse helpers) — mirroring the patterns already in aauth-signing.
• Three behavior-preserving adjustments: AuthTokens.Spec.Builder.build() validates required fields before constructing (validate-then-construct, like SignRequest); TokenExchange/Poller builders normalize default httpClient/sleeper; DeferredResponses.parsePendingResponse rewrites the status normalization to an equivalent form NullAway can prove.

No runtime behavior change; no wire change — pure internal null-safety, so no downstream sync needed (consumers stay on 0.2.3). 214 tests green, coverage + Spotless gates met.

🤖 Generated with Claude Code