fix(napi): omit Option<String> fields from downloadFile when unset

napi-rs 2.16 rejects explicit `null` for `Option<String>` fields on
Linux — only undefined (an omitted property) is accepted. The previous
`authToken: token` form passed `null` when HF_TOKEN was unset, tripping
the type guard. Spread the field conditionally so it's only present when
truthy. Same treatment for sha256, which is null when X-Linked-Etag is
absent.

examples/xet_pkg_napi/smoke.mjs

@@ -89,10 +89,10 @@ console.log(`\nDownloading -> ${destPath}`);
 const t0 = Date.now();
 const result = addon.downloadFile({
     tokenRefreshUrl,
-    authToken: token,
+    ...(token ? { authToken: token } : {}),
     xetHash,
     fileSize,
-    sha256,
+    ...(sha256 ? { sha256 } : {}),
     destPath,
 });
 const elapsedSec = (Date.now() - t0) / 1000;