fix: prevent [object Object] in API error messages

[jlau-stripe]

Problem

When the API returns an error in the nested object shape { "error": { "message": "invalid scope: something" } }, several places in the codebase would coerce that object directly into a string — producing [object Object] in the terminal instead of the actual error message.

1 Example:

Before:

After:

Root causes fixed

1. Auth resources (CLI + SDK) — formatOAuthError interpolated err.error directly. Since err.error can be an object, this produced [object Object]. Fixed by adding extractOAuthErrorMessage which checks typeof err.error at runtime before extracting
   the message.
2. pollDeviceAuth switch bug — switch (err.error) was comparing a string | object union against string case labels. When error was an object, authorization_pending and slow_down never matched, causing the polling loop to throw instead of
   continuing. Fixed by switching on extractOAuthErrorCode(err) (returns string | undefined).
3. error_description regression — The new extractOAuthErrorMessage used a truthy check (if (err.error_description)) instead of nullish (!= null), silently dropping an empty-string description and falling back to the error code instead. Fixed to
   match the prior ?? behavior.
4. Four SDK resources — payment-methods, shipping-address, user-info, and web-bot-auth extracted errors with (body?.error as string | undefined) ?? — a TypeScript-only cast with no runtime guard. A nested object error passed the ?? check and got
   coerced. Fixed by replacing the inline pattern with extractErrorMessage(data, rawBody) from base.ts, which already handles both shapes correctly.
5. useAsyncAction hook — String(err) for non-Error throwables produces [object Object] for plain objects. Fixed to JSON.stringify(err).