[Prototype] Add @shopify/dev-platform-auth package skeleton

[dmerand]

Note

Prototype. This PR is part of an exploratory auth-extraction effort (portable @shopify/dev-platform-auth package). It exists as design evidence and groundwork; do not treat it as a merge candidate until the extraction project is approved.

WHY are these changes introduced?

First structural PR of the auth extraction. The package will hold portable Shopify developer auth flows — Identity device flow and client_credentials — for the CLI and, later, non-CLI JavaScript services. This PR freezes the packaging conventions before any auth code moves in, so reviewers can evaluate the portability contract on its own.

WHAT is this pull request doing?

Scaffolding only; no auth logic. The reviewable substance is the contract:

• ESM with type declarations; Node >=20.10; exactly two exports (. and ./testing); sideEffects: false; zero runtime dependencies
• Three portability guards enforced as tests: a plain-JavaScript (.mjs) consumer imports the built package; the built . entry contains no Node built-ins or require; the . entry bundles for the browser with esbuild
• Workspace wiring: Nx targets, Knip registration, fixed-version changeset set

How to test your changes?

pnpm --filter @shopify/dev-platform-auth build && pnpm --filter @shopify/dev-platform-auth vitest run — the portability tests are the point; the rest is standard CI.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes; package README included
• I've considered analytics changes; none apply to this scaffolding-only change
• The change is user-facing and includes a minor changeset for the new public package