Expand test coverage for auth KEM paths and context sequence number boundaries

[danieldia-dev]

This PR is a collection of small targeted improvements to test coverage and code quality following the authenticated KEM refactor. The refactor introduced extract_and_expand_pieces and updated all three auth paths, but left some gaps: the new function had no direct unit test, the auth KEM layer had no focused roundtrip test, and two context sequence number boundary cases were either missing or weakly asserted. The code quality changes address minor inconsistencies in naming and inlining that were noticed during the same review pass.

The new tests are:

• seal_succeeds_before_message_limit_then_fails (in context.rs): verifies that sealing at seq == u64::MAX - 1 succeeds and that the counter then increments to u64::MAX, at which point the next seal is correctly rejected with MessageLimitReached. The previous test jumped straight to MAX without verifying the last valid operation succeeds.
• extract_and_expand_pieces_matches_concat (in dh.rs): directly verifies that feeding two DH slices into extract_and_expand_pieces produces the same output as feeding their concatenation into the original extract_and_expand.
• x25519_auth_encap_decap_roundtrip (in dh.rs): a focused unit test at the KEM layer that calls auth_encap_with_ikm and auth_decap directly with deterministic inputs, verifying the shared secret matches on both sides. Previously auth coverage only existed through the full HPKE stack in tests/roundtrip.rs, meaning a KEM-layer bug would surface as a (potentially confusing) stack-level failure.

All existing tests still pass, and the new tests pass. In fact, the full test suite was run with --features pq,differential,kat-internals and all 50 unit + 8 differential + 13 KAT + 59 roundtrip tests pass. This is expected, since no functional changes to the codebase have been made.

Finally, the open_rejects_at_message_limit assertion was strengthened to assert_eq!(r, Err(HpkeError::MessageLimitReached)) for consistency with its seal counterpart, and #[inline] was added to extract_and_expand and extract_and_expand_pieces, with sk_s_authed renamed to sk_sender in encap_with for clarity.