toErrorList() discarded everything but the message string from
GraphQL errors, so callers had no way to distinguish error kinds
(e.g. the TOTP lockout from a plain invalid-otp) without matching on
message text. Attach an additive, optional `.code` from the server's
extensions.code (authorizer's GraphQL layer now sets this for typed
service errors) onto the returned Error objects via a new
AuthorizerSDKError type. Non-breaking: existing code reading only
.message is unaffected.

Second-pass review found two things worth tightening:

1. "Purely additive" wasn't quite true: err.code = code adds an
   enumerable own property to a native Error where none existed
   before, so Object.keys(error) and JSON.stringify(error) change
   output on every error that carries a code. Switched to
   Object.defineProperty with enumerable: false so the field is
   readable but genuinely invisible to anything that enumerates or
   serializes the error object.

2. The array-branch conversion logic (message + extensions.code
   extraction) was duplicated byte-for-byte between index.ts and
   admin.ts's toErrorList - exactly the kind of copy that drifts when
   the next extensions.* field gets added to only one of them.
   Extracted to a shared toSDKError in a new src/errors.ts, imported
   by both.

Added a test asserting Object.keys()/JSON.stringify() are unaffected
by a present code.