fix: address RWA test report bugs

[yogeshchoudhary147]

Summary

Fixes 9 bugs and 2 documentation gaps identified in the v1.0.0-beta.0 RWA test report.

• stripIdTokenClaims did not remove sid — sid is an OIDC session identifier sourced from the ID token but was absent from STRIP_CLAIMS. Added alongside the other stripped claims.

• RequireRole threw during SSR, escaping Auth0ErrorBoundary — React error boundaries are client-only. Throwing during SSR bypassed Auth0ErrorBoundary and surfaced at the framework root error handler. Fix: call the hook unconditionally then return null on the server and defer the role check to the client after hydration.

• defineRouteAuth crashed with no parent auth0Middleware — context.get(auth0SessionContext) threw "No value found for context" when the key was never set and the default is undefined. Fix: added a getOptionalContext helper that catches the error and returns undefined instead.

• handleAuth returned HTTP 500 for Auth0Error subclasses — React Router only respects status codes on thrown Response objects; Auth0Error.statusCode is invisible to its error pipeline. Fix: wrapped the dispatch block in handleAuth with a try/catch that converts any Auth0Error to a Response with the correct status code.

• Standalone helpers ignored hooks on user's Auth0Server instance — getSession, updateSession, deleteSession, etc. call an internal getInstance() which creates a fresh Auth0Server with no hooks. Fix: added a public registerAuth0Instance(instance) function so users can register their configured instance as the singleton.

• defineRouteAuth bundled server code into the client (145 kB) — Exporting both handle and middleware from the same defineRouteAuth() call caused React Router's splitRouteModules to pull all server imports into the client bundle. Fix: extracted defineRouteHandle into a zero-import route-handle.ts file. Users should export handle via defineRouteHandle and middleware via defineRouteAuth separately.

• Auth0Server constructor threw at module load, crashing all routes — React Router loads all route modules at startup; a ConfigurationError in any module cascaded to every route including public ones. Fix: deferred config validation and client initialisation to the first auth operation using lazy getters (config, serverClient, stateStore).

• defineRouteHandle still behind browser: null export (RWA-009) — even after extraction, defineRouteHandle was only exported via "./server" which has "browser": null, causing [commonjs--resolver] No known conditions for "./server" specifier in route files. Fix: re-exported defineRouteHandle from the root client bundle (@auth0/auth0-react-router) which has no browser: null restriction.

• deleteSession from a protected action redirected to /page.data (RWA-012) — returning the bare deleteSession response from a protected route action caused React Router to re-run the loader, which redirected to /auth/login?returnTo=/page.data (the internal data-fetch URL). Fix: added an optional redirectTo parameter — deleteSession(request, { redirectTo: '/' }) — that returns a 302 directly, preventing the loader from re-running.

• getAccessToken token refresh prerequisites undocumented — silent refresh silently requires 3 Auth0 Dashboard steps plus offline_access in scope. Fix: added a "Calling APIs with access tokens" section to the README documenting all prerequisites and the TokenError handling pattern.

Test plan

• stripIdTokenClaims — verify sid is absent from the returned user object
• RequireRole — verify Auth0ErrorBoundary catches the 403 on an authenticated user missing a role (no root error boundary renders)
• defineRouteAuth — verify /define-route-auth-demo loads without HTTP 500 when no parent auth0Middleware is present
• handleCallback — verify GET /auth/callback?error=access_denied returns 400, not 500
• registerAuth0Instance — verify onCallback / beforeSessionSaved hooks fire during updateSession / deleteSession after registering the instance
• defineRouteHandle — verify the client bundle for a route that imports defineRouteHandle from @auth0/auth0-react-router builds without browser: null errors
• Auth0Server lazy init — verify a route with a missing AUTH0_DOMAIN starts without crashing and the error surfaces only on the first auth request
• deleteSession({ redirectTo }) — verify a protected route action returns a clean 302 to the specified path with session cookies cleared

[Piyush-85]

LGTM !