fix(sdk-api): route authenticate() to v2 login

[pranishnepal]

What

/api/auth/v1/session is behind a Cloudflare managed challenge that HTTP/Node clients cannot complete, breaking the documented SDK login flow. Route bitgo.authenticate() to /api/v2/user/login instead.

Also:

• Make authenticateWithAccessToken async and await the HMAC strategy setToken() so the token is registered before the caller issues any subsequent signed request (closes a race for async strategies like WebCryptoHmacStrategy). Await at both call sites.

Ticket: WCN-2652

Testing

• Unit Tests
• E2E Testing - login and access token creation

[LOGIN] authenticate() against env=staging ...
[LOGIN] target endpoint expected: https://app.bitgo-staging.com/api/v2/user/login

[LOGIN] SUCCESS
[LOGIN] user = hi@hi.com
[LOGIN] access_token present = true
[LOGIN] access_token = v2x784abeb.............
(node:8377) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)
[LOGIN] /user/me returned user = "hi@hi.com"

[linear-code]

WCN-2652

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run

[mohammadalfaiyazbitgo]

This changes the public method contract from synchronous void to Promise<void>. Consumers that call authenticateWithAccessToken() before issuing signed requests must now await it, and callers that continue ignoring the return value can race asynchronous HMAC token setup. Please treat this as a breaking SDK change: mark the commit accordingly (for example, fix(sdk-api)!: ... plus a BREAKING CHANGE: footer) and audit/migrate all public callers, including the example scripts.

[mohammadalfaiyazbitgo]

Change looks good, but we need to be explicit that the signature change is a breaking change.