Ok; I got it across the line......

My issues were:

1. Using `Authorization: Bearer<token>` the correct value should have been `Authorization: DPoP <token>` thank you @Dan-Ratner

2. When making requests to PDS (/xrpc/com.atproto.repo.createRecord), I was using the entryway (bsky.social) instead of the PDS endpoint. The correct endpoint was extracted from the JWT > "aud" thank you yamarten over at GitHub[1]

3. The final error "message":"DPoP nonce mismatch", I was getting when making PDS requests, was due to the dpop nonce changing/expiring, and I hadn't dealt with the change/reply from requests resulting in 401 errors.

[1] https://github.com/bluesky-social/atproto/issues/3212#issuecomment-2764380250

My code now needs a complete refactor to clean up the implementation