feat(profile-sync-controller): add getCustomerServiceToken method and messenger action

[mathieuartu]

Explanation

References

Related to: https://consensyssoftware.atlassian.net/browse/MUL-1982

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Introduces a new authentication surface that mints audience-scoped tokens for support tooling; behavior follows existing token-exchange patterns but expands who can obtain CS credentials from the wallet.

Overview
Adds getCustomerServiceToken end-to-end so wallet clients can obtain a short-lived token for Customer Service tooling. The flow mirrors existing bearer-token APIs: resolve the SRP (optional entropySourceId), ensure sign-in and an unlocked wallet at the controller layer, obtain an OIDC access token (logging in if needed), then POST /api/v2/customer-service/token with Authorization: Bearer to exchange it for a customer-service–scoped access_token.

AuthenticationController exposes the method and registers AuthenticationController:getCustomerServiceToken on the messenger. The SDK adds CUSTOMER_SERVICE_TOKEN_URL, getCustomerServiceToken in services (with SignInError / RateLimitedError handling), and delegates from SRP and SIWE JWT bearer flows plus the auth facade. Tests and nock fixtures cover success, missing token, HTTP errors, rate limits, not signed in, locked wallet, and endpoint failure.

^{Reviewed by Cursor Bugbot for commit da16264. Bugbot is set up for automated code reviews on this repo. Configure here.}