Frame preview fails because the token is not the signed-in user #2

Connect can succeed, and Frames can create a share link for a published page, and the preview still never opens. The editor stays on "Preparing preview…". On the front end the frame says "The frame could not connect." The browser shows a 502 from WordPress. That 502 is WordPress wrapping the Spacefast error.

Launching the frame session returns 403, code frame_principal_required, detail "Sign in to launch this Frame." The link itself is fine. Spacefast will not open the frame unless the caller is the signed-in user.

Frames registers its OAuth client with token_endpoint_auth_method: client_secret_post and type: web, then sends client_secret when it exchanges the code and when it refreshes. The Spacefast for WordPress plugin registers token_endpoint_auth_method: none and does not send a client secret. That token is the person who signed in. A client secret makes the token an app credential, and frame launch rejects it.

In packages/wordpress-plugin/includes/class-spacefast-frames-api.php, register the client the same way as that plugin, and drop client_secret from start_oauth(), finish_oauth(), and refresh(). People who already connected have to disconnect and connect again, because the stored token is the old kind.