[DivyamTalwar]

Automate authenticated E2E coverage without external accounts. Strict local fixtures exercise the real CLI, bridges, credential storage, and MCP SDK for client credentials and authorization-code login with dynamic registration, S256 PKCE, and rotating refresh tokens.

• Verify two isolated profiles, bearer rejection, bounded renewal, refresh persistence across restart, recovery, logout, and secret-free output.
• Exercise the actual browser/callback boundary with private launchers, including PKCE mismatch, wrong issuer, Host rejection, and denied authorization.
• Register exact test-owned credentials before login; verify cleanup after interruption, denied authorization after registration, and post-token metadata failure while preserving an unrelated sentinel.
• Validated: 1,345 unit tests; Linux Node in both protocol eras with native keyring and file fallback; macOS Node/Bun in both eras with Keychain and Node file fallback; build, fixture type checks, and lint (24 existing warnings, no errors).
• The browser suite explicitly skips Windows until it has a launcher driver; the existing remote OAuth test remains an optional smoke check.

Refs #350. This extends this PR's client-credentials milestone; separate protocol-conformance scope #332 remains outside this change.

Implemented and reviewed with OpenAI Codex in ChatGPT; no Claude Code session was used.