* feat: add positive tests for the Authorization Code Grant
* fix(auth): use import type for AuthorizationServerOptions in types.ts
* fix(auth): make client-id/client-secret optional; rename --secret→--client-secret
* fix(auth): generate PKCE verifier per-run; derive S256 challenge
* fix(auth): build authorization URL with URLSearchParams; drop hardcoded resource
* fix(auth): default token_endpoint_auth_methods_supported to client_secret_basic; add 'none' branch
* fix(auth): check auth-method support before starting callback server
* fix(auth): check error param first; treat state mismatch as fatal; drop fabricated code_challenge assertion
* fix(auth): redact tokens from check details
* fix(auth): harden callback server (path-scoped, close(), error handler, clear timeout)
* feat(auth): print redirect URI and timeout hint before browser prompt
---------
Co-authored-by: Michito Okai <michito.okai.zn@hitachi.com>
