[Prototype] Extract client credentials auth into dev-platform-auth

[dmerand]

WHY are these changes introduced?

This is an exploratory prototype for extracting the client-credentials flow from cli-kit.

The prototype tests whether a portable package can preserve the CLI request, return shape, error behavior, and security boundary. It is not ready to merge.

WHAT is this pull request doing?

• Add @shopify/dev-platform-auth with a client-credentials operation.
• Keep protocol code free of Node and cli-kit imports.
• Keep cli-kit as an adapter with the existing {token, storeFqdn} return shape.
• Return typed package results. Pass server codes through serverCode.
• Keep response bodies, status text, tokens, secrets, and upstream descriptions out of errors.
• Add direct runtime and transport tests.

The branch also carries the earlier contract fixture and portability prototype work.

How to test your changes?

pnpm --filter @shopify/dev-platform-auth vitest --run
pnpm --filter @shopify/dev-platform-auth build
pnpm --filter @shopify/cli-kit exec vitest run src/public/node/session.test.ts

The existing session.test.ts must remain unmodified.

Post-release steps

None. This is an exploratory draft. Do not merge or publish.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type and added a changeset