Remove PKCE field from Config — it was not user configuration but a
command-level decision. The pkce command now calls AuthorizeUserPKCE()
directly instead of mutating the shared Config pointer.

…ON, URL slash

- Zero private key bytes after use in JWT exchange to prevent key material
  lingering in memory until GC (6.1.7)
- Add port validation to validateAuthorizeUserConfig, remove defaultPort
  fallback so the ims package validates its own parameters (N10)
- Replace map[string]interface{} with anonymous struct in refresh command
  for deterministic JSON field order and better performance (N11)
- Trim trailing slash from IMS URL before building JWT claim keys to
  prevent double-slash in metascope URIs (6.2.10)
- Standardize orgs API version error message to match profile style (6.2.12)
- Document PersistentPreRunE override risk in README.md (N7)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The Expires field was set in jwt_exchange.go, exchange.go, and refresh.go
but never read by any caller. The calculations were also wrong:
duration * duration produces nanoseconds-squared (overflow), and
refresh.go used time.Second while the others used time.Millisecond.

Remove the field entirely rather than fixing dead code.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Miscellaneous hardening: key zeroing, port validation, struct JSON

Split AuthorizeUser into AuthorizeUser and AuthorizeUserPKCE