sea-auth-u2m: flip kernel path-dep to napi-binding worktree (carries DA-F1 fix a64479a)

Round-3b follow-up. The sibling-worktree mismatch I flagged in
ee5f03e's commit body has been resolved: per team-lead, the correct
post-D-006 kernel source for napi bindings is the `napi-binding`
worktree, which carries kernel-author's commit a64479a:

  Error::io() → Error::unauthenticated()
  src/auth/oauth/m2m.rs:270
  src/auth/oauth/u2m.rs:433

This reclassifies oauth2 crate `request_async` failures (HTTP 401
`invalid_client`/`invalid_grant`) as `ErrorCode::Unauthenticated`
instead of `ErrorCode::Internal`. With my `decodeNapiKernelError`
mapper routing `Unauthenticated` → `AuthenticationError`, the
DA-F1 contract is now end-to-end intact.

The flip is one line:

  -path = "../../../../databricks-sql-kernel-sea-WT/async-public-api"
  +path = "../../../../databricks-sql-kernel-sea-WT/napi-binding"

Verified the build before committing:
- `npm run build:native` rebuilds against `napi-binding` cleanly
  (1m12s release, no errors).
- Unit tests: 85/85 still pass (no behavior change in the JS
  adapter; this commit is purely a Rust-source rebase).
- Bad-secret e2e: **PASSES** the typed-class assertion.

  ✔ rejects with AuthenticationError when oauthClientSecret is
    deliberately wrong (230ms)

  Confirms the DA-F1 parity gate end-to-end: kernel-side OAuth
  failures now surface as `AuthenticationError`, not raw `Error`
  with sentinel-prefixed message.

The happy-path e2e still fails with `invalid_client` — that's the
pre-existing workspace SP-registration issue (`DATABRICKS_PECO_*`
env vars are not registered on the pecotesting workspace). Verified
unchanged via direct curl. Environmental, not code.

Co-authored-by: Isaac

Author: msrathore-db

native/sea/Cargo.toml

@@ -30,9 +30,12 @@ crate-type = ["cdylib"]
 napi = { version = "2", default-features = false, features = ["napi6", "async"] }
 napi-derive = "2"
 
-# Kernel — path dep on the async-public-api branch worktree. Once the
+# Kernel — path dep on the napi-binding branch worktree (D-006: the
+# napi-binding-facing source of truth post-relocation; carries kernel-
+# author's a64479a `Error::unauthenticated()` reclassification for
+# OAuth token-exchange failures that DA-F1 depends on). Once the
 # kernel is published this becomes a version dep.
-databricks-sql-kernel = { path = "../../../../databricks-sql-kernel-sea-WT/async-public-api" }
+databricks-sql-kernel = { path = "../../../../databricks-sql-kernel-sea-WT/napi-binding" }
 
 # Tokio is a transitive dep via the kernel and via napi's `async` feature;
 # declared explicitly so we can name `tokio::runtime::Handle` and