[Prototype] Add characterization tests for auth session modules

[dmerand]

Note

Prototype. This PR is part of an exploratory auth-extraction effort (portable @shopify/dev-platform-auth package). It exists as design evidence and groundwork; do not treat it as a merge candidate until the extraction project is approved.

WHY are these changes introduced?

We plan to move the auth/session protocol code into a reusable package. Before any code moves, its current behavior must be pinned by tests that exist independently of the move. Then the extraction can prove it changed nothing: same tests, same results, different location.

WHAT is this pull request doing?

Test-only. Pins the contracts the extraction relies on, in packages/cli-kit/src/private/node/session/:

• exchange.test.ts — exact token-request parameters for refresh and application-token exchange (admin destination/store, ${store}-${appId} result keying), all-or-nothing fan-out, device-code error mappings, token construction (expiry, scopes, JWT sub, missing-user error)
• scopes.test.ts — per-API scope mappings and deduplication
• validate.test.ts — missing application token handling; expiration-margin boundary (just inside vs just outside)
• schema.test.ts (new) — session schema shape, Date serialization round-trip, cached identity structure validation

No production changes. No existing assertions modified. device-authorization.ts is excluded while #8269 and #8270 are in flight; its coverage completes this PR after they merge.

How to test your changes?

pnpm --filter @shopify/cli-kit vitest run src/private/node/session/

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — not user-facing: test-only, no changeset needed