[rvitaliy]

Closes #1009.

Accept private P-256 (prime256v1) KeyObject values alongside base64url strings for VAPID private keys. Pass prepared keys directly to the existing jws signer, avoiding repeated decoding, ASN.1/PEM encoding and key parsing.

Keep string behavior, ES256/JWT claims and expiration, both content encodings, global reset and per-request overrides unchanged. Reject public, symmetric, RSA and other-curve key objects. Includes documentation and 15 regression cases, including signature verification, payload decryption and a loopback HTTPS send.

Validation (local macOS):

• 146 local tests passed on Node.js 22.23.4, 24.22.2 and 26.13.1; lint passed.
• Against unmodified upstream, the new test file has 13 failures; all 15 cases pass with this change.
• Eleven alternating samples of 1000 operations on Node.js 26.13.1: complete encrypted request construction 191.11 → 163.90 µs median (−14.2%); VAPID headers 56.54 → 28.78 µs (−49.1%). Key import occurs once outside the loop. These measure synchronous CPU, not network latency.

Live browser tests against FCM/Mozilla and hosted CI have not been verified locally.