feat: accept accessToken as alternative auth in createCheckoutSession

[mmelnyk-godaddy]

Summary

• Add accessToken as direct Bearer token option for createCheckoutSession
• Mutually exclusive with existing clientId/clientSecret OAuth flow
• TypeScript discriminated union (never fields) enforces at compile time, runtime check as safety net
• 6 unit tests covering both auth paths, caching, and error cases

Changes

• packages/react/src/types.ts — CheckoutSessionAuth discriminated union type
• packages/react/src/server.ts — accessToken direct path + runtime validation
• packages/react/src/server.test.ts — 6 unit tests (new file)

Test plan

• accessToken direct path bypasses OAuth flow
• clientId/clientSecret OAuth path unchanged (backward compatible)
• Mutual exclusivity throws clear error
• No-auth failure handled gracefully
• Token caching isolated to OAuth path only
• All 6 tests pass

DEVX-1079

[mmelnyk-godaddy]

Maestro Agent Metrics

Agent	Duration	Tokens In	Cache Write	Cache Read	Tokens Out	Status
maestro-orchestration:architecture-reviewer	0m 2s	0	0	0	0	Unknown
maestro-orchestration:coder	0m 0s	0	0	0	0	Unknown
maestro-orchestration:testing-reviewer	0m 2s	0	0	0	0	Unknown

Run ID: 20260908_120000

[changeset-bot]

⚠️ No Changeset found

Latest commit: 64cab26

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR