@W-23235332 fix(slas): drive PKCE for registered login on private clients

[clavery]

Summary

Fixes b2c slas token registered-customer login failing against a private SLAS client (one with a secret) with:

ERROR: SLAS token exchange (authorization_code) failed (HTTP 400) — { "status_code": "400 BAD_REQUEST", "message": "code_verifier is required" }

Root cause: the registered flow's /oauth2/login step always presents a PKCE code_challenge, but the SDK's getRegisteredToken downgraded the private-client token exchange to grant_type=authorization_code and omitted the code_verifier. Having received the challenge at login, SLAS then rejects the exchange.

Fix: unify the registered token exchange so it always uses grant_type=authorization_code_pkce with the matching code_verifier for both public and private clients; a private client additionally authenticates with its secret via HTTP Basic. This matches the canonical behavior in commerce-sdk-isomorphic's loginRegisteredUserB2C. Guest and client_credentials flows are unchanged.

Registered login now works on both public and private clients.

Also fixes the SDK unit test that had codified the buggy authorization_code contract (which is why CI stayed green while the live server failed); it now asserts the PKCE + code_verifier + Basic-auth wire contract. Docs (docs/cli/slas.md flow table) and the b2c-slas skill are updated.

Testing

Verified live against a private SLAS client (mystorefront-zzpq-019, Private: true) on instance zzpq-019:

1. Reproduced the bug on pre-fix code — registered login (--shopper-login/--shopper-password) against the private client returned HTTP 400 code_verifier is required.
2. Confirmed the fix — the same command returned a valid registered shopper token. Decoded JWT shows sty: User and isb: ...upn:<shopper>... (a genuine registered login, not guest).
3. Regression — guest client_credentials on the same private client still issues a token successfully.

To reproduce manually:

b2c slas token --site-id <site> \
  --slas-client-id <id> --slas-client-secret <secret> \
  --shopper-login <login> --shopper-password '********'

Dependencies

• No net-new third-party dependencies were added