feat: add auth0_get_quickstart_guide tool (DXAA-555)

[GilbertLS]

Note: This branch is stacked on feat/DXAA-auth0-save-credentials-to-file-onboarding-updates, which is not yet merged to main. This PR targets that parent branch and only covers the commits from 2f670fc onward (the auth0_get_quickstart_guide work).

Changes

Adds the auth0_get_quickstart_guide MCP tool, which fetches a framework-specific Auth0 quickstart implementation prompt, configures the application's callback URLs, and returns a ready-to-implement prompt.

• New tool auth0_get_quickstart_guide (src/tools/quickstarts.ts): given client_id, framework, and project_path, it resolves callback URLs from project config, fetches the quickstart LLM prompt from CDN, injects runtime values, updates the Auth0 application's callback/logout/web-origin URLs, and returns the resolved prompt. Requires read:clients and update:clients; marked localOnly.
• New utility src/utils/quickstart-guide.ts: resolvePlaceholders (injects runtime values into the prompt template) and calculateUrlUpdates (computes the minimal application URL patch).
• Secret masking: client secret and session cookie secret placeholders are masked (*******MASKED*********) in the injected input values so secrets are never written into the returned prompt.
• .env detection: when a quickstart spec includes an env snippet, the tool detects an existing env file (e.g. .env.development) before falling back to the spec's preferred filename, and instructs the caller to reuse it rather than create a new one.
• Shared helpers: framework validation now uses the shared isFrameworkSupported / SUPPORTED_FRAMEWORKS from utils/onboarding.ts (case-insensitive, consistent with fetchQuickstartSpec), and non-verifiable callback handling uses the shared hasNonVerifiableCallbacks helper, removing duplicated logic.
• Registered the tool in src/tools/index.ts.

References

• https://auth0team.atlassian.net/browse/DXAA-555

Testing

Unit tests cover the new tool handler, the placeholder/URL-update utilities, and the shared onboarding helpers — including framework validation (valid, unsupported, and mixed-case), .env detection and missing-file handling, secret masking, callback-URL update calculation, and error paths (missing params, spec unavailable, app not found, CDN failure).

Run: npx vitest run test/tools/quickstarts.test.ts test/utils/quickstart-guide.test.ts test/utils/onboarding.test.ts

• This change adds unit test coverage
• This change adds integration test coverage

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors