fix: address SPA test report issues

[yogeshchoudhary147]

Summary

Fixes and documents all issues identified in the v1.0.0-beta.0 SPA mode test report.

• SPA-001 — Added SPA mode section to README covering activation, environment variables, persistent sessions 3-step setup (Allow Offline Access, Refresh Token grant, localstorage + offline_access), and Auth0 Dashboard config notes.

• SPA-002 — Fixed RequireRole throwing InsufficientScopeError during SPA SDK init before auth state is known; now returns null while isLoading is true. Also fixed SignedOut rendering during init — suppresses the login button flash by checking isLoading before rendering.

• SPA-003 — Clarified VITE_AUTH0_AUDIENCE env var description to explain opaque JWE token vs signed RS256 JWT behavior.

• SPA-004 — Documented that getSession, requireSession, getUser, requireUser, and getAccessToken always return null or redirect in pure SPA mode, with a substitution table pointing to the client-side equivalents.

• SPA-005 — Documented useUser() claim shape differences: RWA returns full ID token claims (iss, aud, iat, exp, sid); SPA returns profile fields only because auth0-spa-js strips JWT metadata automatically.

• SPA-006 — Documented the AuthLoading pattern for handling the SDK init window so UIs don't snap from blank to authenticated state.

• SPA-007 — Documented that all loader guards (requireSession, requireUser) are RWA-only and SPA apps must use component guards (RequireAuth, withAuthenticationRequired).

• SPA-008 — Added hybrid mode (both AUTH0_* and VITE_* set simultaneously) to Known Limitations as unsupported, with explanation of the session cookie / localStorage split that causes the security gap.

Test plan

• RequireRole renders nothing during SPA init — does not throw for users with the role
• RequireRole still throws InsufficientScopeError for unauthenticated users after init
• SignedOut renders nothing during isLoading: true — no login button flash on page load
• SignedOut renders children after init when user is not authenticated
• npm test passes