Retrieves a registered customer access token from SLAS.
Uses the /oauth2/login endpoint with shopper credentials, then exchanges the authorization code for an access token.
The registered-customer flow is PKCE-protected for both public and private clients: a code_challenge is always presented at the /oauth2/login step, so the matching code_verifier must always be sent at the token exchange with the authorization_code_pkce grant.
Public client: PKCE token exchange (no client secret).
Private client: PKCE token exchange, plus HTTP Basic authentication using the client secret. The client must NOT drop PKCE, or SLAS rejects the exchange with 400 code_verifier is required.