Make authorizationUrl and launch exclusive

[mina-asham]

• With the release of version 2, we added the launch option to customize launching the authorizationUrl, but if launch is not provided then authorizationUrl shouldn't be provided as it's unused, this makes both options exclusive
• Fixes: Enhancement: V2 API shouldn't require authorizationUrl if launch is not supplied #30

[koistya]

Hey! Just pushed a follow-up commit that tightens things up a bit.

The core idea of your PR is solid — making these options exclusive makes the API clearer. I noticed a few rough edges while testing:

1. Runtime bug: When browser-auth passes launch: this._launch and _launch is undefined, the "launch" in options check still returns true (key exists, value is undefined), which would try to call undefined(). Switched to typeof launch === "function" to be safe.

2. Types: Made the two modes more explicit — Headless (no URL, no launch) vs Managed (both required). Added never constraints so the intent is clearer in the type definitions.

3. browser-auth: Updated to conditionally build the options object based on whether _launch exists, so it properly uses headless mode when no launcher is configured.

4. Usability: Added a small getRedirectUrl() helper so headless users can easily build the redirect URI for their auth URL without having to know the internal URL structure.

5. Tests: Updated a few tests that were passing authorizationUrl without launch to use proper headless mode instead.

Let me know what you think.

[mina-asham]

Hey! Just pushed a follow-up commit that tightens things up a bit.

The core idea of your PR is solid — making these options exclusive makes the API clearer. I noticed a few rough edges while testing:

1. Runtime bug: When browser-auth passes launch: this._launch and _launch is undefined, the "launch" in options check still returns true (key exists, value is undefined), which would try to call undefined(). Switched to typeof launch === "function" to be safe.
2. Types: Made the two modes more explicit — Headless (no URL, no launch) vs Managed (both required). Added never constraints so the intent is clearer in the type definitions.
3. browser-auth: Updated to conditionally build the options object based on whether _launch exists, so it properly uses headless mode when no launcher is configured.
4. Usability: Added a small getRedirectUrl() helper so headless users can easily build the redirect URI for their auth URL without having to know the internal URL structure.
5. Tests: Updated a few tests that were passing authorizationUrl without launch to use proper headless mode instead.

Let me know what you think.

Looks good to me, I have a couple of nit picks (sorry wasn't fast enough to comment before merge):

• Probably worth pulling the defaults into constants now that they are used in two places (getRedirectUrl and getAuthCode)
• We can strengthen this condition from: "authorizationUrl" in options && typeof (options as any).launch === "function" to "authorizationUrl" in options && options.authorizationUrl && "launch" in options && typeof options.launch === "function"

Thanks for fixing the rest of the bits I missed, love the use of never I felt I was missing something with my typing!

[koistya]

Both suggestions are reasonable improvements, indeed! Pushed in update in #32.