Thanks for the help. I got it working using browser-based authentication.
I had to create an Integration with certain settings for TBA and User login credentials, and also a localhost callback URL on port 7777 (which is coincidentally the same port number used by default for Unreal Engine projects; totally unrelated), that's all as per SuiteAnswers.
The Integration's Consumer Key and Secret go in the developer tool's root folder in the .env file. Once that's in place, the gulp extension:fetch --to command pops open a browser window using the Integration to generate what I think is a per-session Access token, and then clicking the button in the browser allows the process to continue from there, and a New Token is created for the extension developer tools, using a name I type in.
Summary: I was able to get the fetch command to work, I just had to create an Integration. This is basically the exact same way I authenticate my SuiteCloud Developer Framework projects in Visual Studio Code.