fix: RWA gaps — optional appBaseUrl and session hooks

[yogeshchoudhary147]

Summary

• AUTH0_APP_BASE_URL is now optional. When not set, the app base URL is inferred from the incoming request origin. Production deployments behind a reverse proxy should still set it explicitly.
• Added beforeSessionSaved hook to Auth0Server. Called before the session is encrypted into the cookie — use it to transform the session (e.g. strip OIDC metadata claims with stripIdTokenClaims to reduce cookie size).
• Added onCallback hook to Auth0Server. Called after a successful authentication callback with the full Auth0Session — use it to provision users in your own database on first login.

Test plan

• All 333 existing tests pass
• AUTH0_APP_BASE_URL omitted locally — login and logout work, redirect_uri inferred from request
• AUTH0_APP_BASE_URL set explicitly — behaviour unchanged
• beforeSessionSaved strips claims before session is written to cookie
• onCallback fires after successful login with the correct session