feat: enterprise connect support

[rmad17]

Added

• Adds Enterprise Connect mode via enterprise_connect=True, where Auth0 is a pure SSO relay: it verifies the user at the enterprise IdP and returns claims, but holds no session and issues no refresh token. The app owns the session. Framework-agnostic RWA: no routes, no cookies, needs only a transaction_store. Callback tokens go to the integrator's server, never the browser.
• Adds start_enterprise_login(options, store_options), the single EC entry point: validates the email, runs WebFinger discovery, and returns an authorize URL with login_hint for a managed domain or None otherwise. Only a per-login organization is forwarded — the static client-level org is never auto-applied, so multi-customer deployments aren't all routed to one org.
• Adds an EC branch to complete_interactive_login. Signature and issuer validation still run first, then it returns {user, token_set, id_token, domain} (plus app_state when set) without persisting a session, and consumes the transaction. Raises ApiError("invalid_response") on no verifiable claims. org_id is surfaced but not validated by the SDK — the domain-based routing to a connection is a hint, not a security control, so validating org_id post-callback is the integrator's responsibility.
• Adds WebFinger discovery via the exported is_federated_domain(domain, email_domain) and internal _is_federated_domain. Fails closed to False on any error or non-200/404, caches in a FIFO store bounded at 1000 (TTL 60s found / 15s not-found), and warns on 429.
• Adds a misuse guard that rejects session/refresh-dependent members instead of failing silently. get_session/get_access_token raise EnterpriseConnectError (enterprise_connect_session_unavailable / enterprise_connect_access_token_unavailable). User linking, connected accounts, session transfer, passkey sign-in, CIBA, login_with_custom_token_exchange, and the mfa/passwordless sub-clients raise enterprise_connect_method_unavailable. handle_backchannel_logout is a no-op.
• Adds federated logout: logout appends federated=true to https://{domain}/v2/logout when LogoutOptions.federated is set. The local store delete is guarded so an EC client with no store doesn't crash.
• Adds init-time warnings when EC is paired with settings it ignores: offline_access in scope and a static organization.
• Adds typed models (StartEnterpriseLoginOptions, LogoutOptions.federated) and errors (EnterpriseConnectError + EnterpriseConnectErrorCode). URL.create_logout_url gains a federated flag.