fix: remove Auth0Server dependency from getClaims and requireClaims

[yogeshchoudhary147]

Summary

• getClaims and requireClaims no longer require a full Auth0Server config
• verifyJwt now reads AUTH0_DOMAIN and AUTH0_AUDIENCE directly from env vars instead of calling getInstance(), which triggered the full session config validation
• API-only deployments now only need two env vars instead of five

Before this fix, a developer using only requireClaims was forced to set AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SESSION_SECRET, and AUTH0_APP_BASE_URL — none of which are used during JWT verification.

Test plan

• requireClaims / getClaims work with only AUTH0_DOMAIN + AUTH0_AUDIENCE set
• ConfigurationError thrown when AUTH0_DOMAIN is missing
• ConfigurationError thrown when AUTH0_AUDIENCE is missing
• Full SSR session flow unaffected
• npx vitest run — all 320 tests pass

[Piyush-85]

src/server/api.ts:67 — small doc nit: the @throws on getClaims still says "if AUTH0_AUDIENCE is not configured", but verifyJwt now also throws ConfigurationError when AUTH0_DOMAIN is missing. Worth updating that line to mention both. (Couldn't leave this inline — the line isn't part of the diff.)