Add PSTokenHints interface covering all optional AAuth spec §8.1 PS token
endpoint parameters (login_hint, domain_hint, tenant, justification,
platform, device, upstream_token, subagent_token, prompt, capabilities).

ProxyConfig gains two new optional fields:
- psHints?: PSTokenHints — spread into every exchangeAtPS() body; capabilities
  defaults to ['interaction'] when psHints.capabilities is absent
- onAuthToken?: (token: string) => void | Promise<void> — called with each
  auth_token received from the PS before use; hosts can record or validate
  the PS sub across exchanges

Both call sites in invokeAtResource() (R3 exchange + W2 escalation) pass cfg
to exchangeAtPS(). PSTokenHints exported from the package root.

Also improves registry fetch errors with response body detail.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>