pub fn bytes_from_b64_strict(bytes: &[u8]) -> Result<Vec<u8>, String>
Strict standard-base64 decode (single SIMD pass): rejects url-safe chars, whitespace and bad padding, matching @smithy/util-base64 semantics.