pub fn b64a_decode(s: &str) -> Result<Vec<u8>, String>
Decode a B64A string into bytes. Validates canonical zeroed trailing bits.