fix default Supabase auth fetch boundary

[artiphishle]

Summary

• Restore the default Supabase Auth fetch boundary to a late-bound wrapper around
  globalThis.fetch.
• Preserve explicitly injected config.fetch as the stable captured implementation.
• Add regression coverage for default email/password auth, custom fetch stability, and OAuth
  PKCE through the same corrected default fetch boundary.

Regression Proof

Phase 3 changed the default fetch implementation from a wrapper to a captured raw function:

const fetchImplementation = config.fetch ?? globalThis.fetch;

That captured function is later invoked as normalizedConfig.fetch(...), which can change the
fetch receiver. The new receiver-sensitive regression test installs globalThis.fetch before
adapter creation, does not replace it afterward, and requires the fetch receiver to remain
globalThis.

Against the old Phase 3 implementation, the new test failed with:

error: expect(received).toMatchObject(expected)

Received:
{
  "ok": false,
  "error": {
    "cause": [TypeError: incorrect fetch receiver],
    "code": "network_error",
    "message": "Unable to reach Supabase Auth."
  }
}

With the restored wrapper:

(input, init) => globalThis.fetch(input, init)

the same test passes:

(pass) createSupabaseAuthAdapter > calls the default global fetch with the global receiver

The earlier runtime-replacement test still proves late-bound default fetch behavior, but the
receiver-sensitive test covers the production-like initialization timing where globalThis.fetch
is installed before the generated auth adapter is imported.

Validation

• bun run build
• bun run test
• bun run typecheck
• bun run lint
• bun run format:check
• bun run knip
• bun run docs
• npm --cache /private/tmp/supabase-auth-npm-cache pack --dry-run