canceledAtEmailPrompt and canceledAtOtpPrompt were closure booleans
set inside prompt callbacks to detect user cancellation after the
fact. Fragile if authenticate ever retries prompts or changes order.
In the command context both prompt functions are always provided, so
AuthError(NO_TOKEN) unambiguously means the user declined to enter
required input. Check the error code directly instead.