chore(deps): bump @adcp/client 5.9.0 -> 5.9.1

[bokelley]

Scoped patch bump to pick up adcp-client#752.

Why

5.9.0's default context.no_secret_echo assertion in @adcp/client/testing silently no-ops for every consumer passing structured TestOptions.auth. The relevant code in default-invariants.ts:

const optAny = ctx.options as unknown as { auth?: string };
if (optAny.auth) secrets.add(optAny.auth);  // 'auth' is really an object
// later:
if (dumped.includes(secret)) { ... }         // String.includes(obj) → matches [object Object]

Since #2771 adopted 5.9.0 and dropped our stricter local assertions in favor of the SDK defaults, we were implicitly depending on the default to work — but it doesn't, for any auth type other than a loose options.auth_token string. A compliance run that should have flagged a leaked access token, basic password, or client secret was passing cleanly.

What 5.9.1 fixes

• extractAuthSecrets walks every variant of the TestOptions.auth union and pulls leaf strings: token (bearer), password (basic) plus the base64(user:pass) Authorization header blob, tokens.access_token / tokens.refresh_token (oauth and oauth_client_credentials), client.client_secret (oauth confidential), credentials.client_secret with $ENV:VAR reference resolution (oauth_client_credentials).
• SECRET_MIN_LENGTH = 16 guards against short fixture values driving false positives.
• Not extracted: client_id (RFC 6749 §2.2 — public identifier) or basic-auth username alone (not a secret; the base64 header blob catches real leaks of the credential).

Also adds registerAssertion(spec, { override: true }) for consumers who want to swap a default for a stricter local version — not needed here post-#2771, but doesn't hurt to have in scope.

Scope

• package.json: "@adcp/client": "^5.9.0" → "^5.9.1"
• package-lock.json: 5 lines (just @adcp/client's resolved + integrity)
• No code changes, no peer cascade, no API surface changes

Verification

• npm run typecheck clean
• npm run test:server-unit — 1699 passed / 34 skipped / 0 failed
• collection-lists-storyboard.test.ts (the one test whose fixture loading had flaked in earlier sessions) — passes cleanly on fresh install

🤖 Generated with Claude Code