Return both PlayFab entity tokens in auth callbacks

[Daniel-Ric]

Motivation

• Provide the PlayFab master_player_account EntityToken (and its expiration) in addition to the default entity token so downstream clients can act with the master account when available.
• Ensure the new fields are returned consistently from auth endpoints and discoverable in the API schema and debug tooling.

Description

• Updated src/routes/auth.routes.js to request a second entity token for master_player_account when PlayFabId is present and include entityTokenMaster and entityTokenMasterExpiresOn in callback/refresh responses via buildAuthCallbackResponse.
• Added src/utils/authResponse.js with buildAuthCallbackResponse to centralize shaping of the auth callback response and extended it to include the master token fields (entityTokenMaster, entityTokenMasterExpiresOn).
• Extended src/utils/swagger.js to add the two new fields to the AuthCallbackResponse schema.
• Updated src/routes/debug.routes.js to extract and decode the master entity token when decoding callback bundles.
• Added/updated tests/authResponse.test.js to validate the mapped callback payload includes the new master token fields.

Testing

• Ran npm test, which executed the unit test suite including tests/authResponse.test.js, and all tests passed (7/7).

---

Codex Task