Overview
Adds Cloudflare Turnstile support for passwordless login in commerce-sdk-react by sending the Turnstile token in authorizePasswordless requests so the BFF/MRT can verify it before forwarding to SLAS.
Changes

1. packages/commerce-sdk-react/src/auth/index.ts
   Extended AuthorizePasswordlessParams with turnstileResponse?: string.
   When turnstileResponse is present, uses a custom fetch instead of the commerce-sdk-isomorphic helper (which does not send the token).
   Custom fetch sends a POST to the SLAS proxy with turnstileResponse in the body.
   Added slasClientBaseUrl for the custom fetch URL.
   Improved error handling for non-200 responses (empty body, 404 for guest users).
2. packages/commerce-sdk-react/src/auth/index.test.ts
   Added authorizePasswordless with turnstileResponse uses custom fetch instead of helper.
   Added authorizePasswordless with turnstileResponse throws on non-200 fetch response.
   Adjusted existing error-handling test to use text() instead of json() for the mock response.

Design: https://docs.google.com/document/d/1qV1CVhtWWUGv_Q5On--PjohkNhDInUdUkqN-H4_VgE8/edit?tab=t.ax8cd1bs7a74

Description

Types of Changes

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Documentation update
• Breaking change (could cause existing functionality to not work as expected)
• Other changes (non-breaking changes that does not fit any of the above)

Breaking changes include:

• Removing a public function or component or prop
• Adding a required argument to a function
• Changing the data type of a function parameter or return value
• Adding a new peer dependency to package.json

Changes

• (change1)

How to Test-Drive This PR

• (step1)

Checklists

General

• Changes are covered by test cases
• CHANGELOG.md updated with a short description of changes (not required for documentation updates)

Accessibility Compliance

You must check off all items in one of the follow two lists:

• There are no changes to UI

or...

• Changes were tested with a Screen Reader (iOS VoiceOver or Android Talkback) and had no issues
• Changes comply with WCAG 2.0 guidelines levels A and AA
• Changes to common UI patterns and interactions comply with WAI-ARIA best practices

Localization

• Changes include a UI text update in the Retail React App (which requires translation)