fix(auth): stop sending apiKey as client_secret in OAuth token exchange body

[radenkovic]

Summary

• Removes the auto-population of clientSecret from apiKey in exchangeCodeForToken and refreshAccessToken
• The apiKey is already sent via Authorization: Bearer header on every request — including /v3/connect/token — so including it in the body was redundant and broke reverse proxy credential-injection patterns
• clientSecret remains available on CodeExchangeRequest / TokenExchangeRequest for callers who have a distinct OAuth client secret to pass explicitly

Fixes #703
Jira: TW-5724

Test plan

• Updated existing "should default clientSecret to the API key" tests → now assert clientSecret is absent from the body when not provided
• All auth.spec.ts tests pass (auth.ts at 100% coverage)
• Verify exchangeCodeForToken and refreshAccessToken still work end-to-end when clientSecret is not passed (relying on the Authorization header)
• Verify explicit clientSecret in the request is still forwarded correctly in the body

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.75%. Comparing base (a970008) to head (bcf5ae2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #753      +/-   ##
==========================================
- Coverage   98.75%   98.75%   -0.01%     
==========================================
  Files          43       43              
  Lines        1045     1041       -4     
  Branches       92       90       -2     
==========================================
- Hits         1032     1028       -4     
  Misses         12       12              
  Partials        1        1              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.