feat: add support for enterprise connect

[rmad17]

Changes

Added

• Adds ServerClient(enterprise_connect=True) for embedded Enterprise Connect login. Auth0 acts as a pure SSO relay: it authenticates the user through their company identity provider and returns verified claims, issues no refresh token, and holds no session. The application owns the session. Early Access.
• Adds start_enterprise_login(StartEnterpriseLoginOptions), which runs WebFinger discovery on the email domain and returns an authorization URL with login_hint when the domain is managed, or None when it is not. Also adds a standalone, stateless is_federated_domain(domain, email_domain) helper exported from auth0_server_python.auth_server.
• complete_interactive_login() in Enterprise Connect mode returns a dict {user, token_set, id_token, domain, app_state?} (verified claims plus the one-time access token) instead of persisting a session. PKCE and state are enforced on the code exchange, as in every other interactive login.
• Guards 25 session- and refresh-dependent members (get_session, get_access_token, refresh, connected accounts, link/unlink, passkey, custom token exchange, session transfer, and the mfa / passwordless properties) to raise EnterpriseConnectError in this mode. The guard is the first statement in each member and fires before any argument is used or any network call is made. It is a verified no-op when the flag is off.
• Adds the typed error EnterpriseConnectError with a single stable code EnterpriseConnectErrorCode.NOT_SUPPORTED = "enterprise_connect_not_supported", and the StartEnterpriseLoginOptions option model.
• Adds federated to LogoutOptions and the logout URL builder, which appends federated=true to the Auth0 logout URL. Enterprise Connect logout should be federated: a non-federated logout leaves the enterprise identity provider session live, so the next login silently re-authenticates. Federated logout also ends the user's session at other apps that share the same enterprise SSO.
• Surfaces org_id from the verified claims but does not enforce it. Organization validation is the application's authorization decision, documented in the guide. Flagging for reviewer visibility - the SDK does not enforce organization membership in this mode by design.
• Warns at construction when offline_access scope or a static organization is set in Enterprise Connect mode, since neither applies without a refresh token or with IdP-resolved organizations.
• Adds Enterprise Connect documentation (examples/EnterpriseConnect.md) and README links. No breaking change: everything is gated behind enterprise_connect=True (default off).

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors