Exchange clientSecret for tokens after app registration + bump canary (#19582)

## Summary

- **Fix `createApplicationRegistration` flow**: The server's
`createApplicationRegistration` mutation returns a `clientSecret`, not
`accessToken`/`refreshToken` directly. The SDK now correctly requests
`clientSecret` and immediately performs an OAuth `client_credentials`
exchange to obtain `appAccessToken` and `appRefreshToken`, then stores
them in config.
- **New `exchangeCredentialsForTokens` helper**: Shared by both `dev`
and `dev --once` flows. Takes `clientId` + `clientSecret`, calls
`/oauth/token` with `client_credentials` grant, and persists the
resulting tokens.
- **Bump `twenty-sdk`, `twenty-client-sdk`, `create-twenty-app` to
`1.22.0-canary.2`**

## Context

The `1.22.0-canary.1` SDK release expected
`createApplicationRegistration` to return `accessToken`/`refreshToken`
directly, but the `v1.22.0` server returns `clientSecret`. This caused
`yarn twenty dev` and `yarn twenty dev --once` to fail with "No
registration found" errors.

packages/twenty-sdk/src/cli/utilities/api/application-api.ts

@@ -109,8 +109,7 @@ export class ApplicationApi {
         universalIdentifier: string;
         oAuthClientId: string;
       };
-      accessToken: string;
-      refreshToken: string;
+      clientSecret: string;
     }>
   > {
     try {
@@ -122,8 +121,7 @@ export class ApplicationApi {
               universalIdentifier
               oAuthClientId
             }
-            accessToken
-            refreshToken
+            clientSecret
           }
         }
       `;