JPM OAuth implementation

Generate JWT-signing + access-token-exchange code that follows JPM's IDAnywhere OAuth contract. The generated module caches the access token until just before its server-set expiry, so the merchant's app reuses one token across many API calls instead of regenerating per request.

This skill is typically invoked from the end of jpm-integrations-get-started (its Step 4). When run standalone, it gathers the same inputs interactively.

Step 1 — Verify prerequisites

The merchant must have all four of:

• clientId (e.g. CC-123456-D12992-232222-TEST)
• certificate path (PEM .cer from JPM)
• private key path (PEM key paired with the certificate)
• SHA-1 thumbprint of the cert (40 hex chars; colons optional — code will normalize)

If you arrived from jpm-integrations-get-started, these are already in conversation context — use them.

If invoked standalone:

1. Ask the user where the credentials live: file paths, an .env, or in conversation.
2. If anything is missing, tell the user to run jpm-integrations-get-started first and exit. Do not invent placeholder values.