test(browser): close mutation-testing coverage gaps in passkeys SDK

[wolpert]

What

Adds the missing test assertions that StrykerJS mutation testing — introduced by @bernata in #39 — flagged in the passkeys-browser SDK. The report scored 65.1% and pinpointed code that ran in tests but had no assertion pinning its behaviour, so a mutated version still passed. This closes those gaps.

Credit to @bernata for wiring up the tooling that surfaced these blind spots — line coverage hid them; mutation coverage did not.

Gaps closed (each new case kills a previously-surviving mutant)

• results.ts had zero coverage (0% mutation score). New results.test.ts pins both branches of isCeremonySuccess / isCeremonyFailure and the success-narrowing path.
• http.ts — assert the accept header is always sent; content-type/body are omitted on body-less requests; JSON null/primitive bodies leave PkAuthHttpError.data undefined (the && vs || object check); and an absent getToken yields the friendly validation error, not a raw TypeError.
• refresh.ts — assert the negative branch of both type guards, the default /auth/refresh path, and that a non-JSON 401 body maps to "unknown" instead of throwing (the e.data?.detail optional-chaining branch).
• admin.ts — cover the two previously-untested methods (completeEmailVerification, startPhoneVerification) and add a matrix asserting every admin call carries the Bearer token, so the authenticated flag can no longer be mutated to false undetected.

Intentionally left alone

A handful of remaining base64url survivors are equivalent mutants (out-of-bounds typed-array writes are ignored, atob is lenient, the padding-regex anchor is moot for btoa output) — no test can kill them without contrived inputs, so they're documented rather than chased.

Verification

• All 67 browser-SDK tests pass (npx vitest run)
• tsc --noEmit clean

🤖 Generated with Claude Code