- Add _compute_fgp(user_agent, accept_lang) helper returning 16-char hex HMAC-SHA256 fingerprint (D-04); uses existing hmac + hashlib imports - Extend create_access_token signature with user_agent/accept_lang params (empty-string defaults for backward compatibility, D-05) - Embed fgp claim in every issued access token payload