fix: address API resource server test report issues

[yogeshchoudhary147]

Summary

• API-001: requireClaims and requireClaimsFromContext now throw Response objects (401/403 JSON) instead of BearerTokenError/InsufficientScopeError Error instances. React Router forwards thrown Response objects directly to the client as HTTP responses; thrown Error instances fall into the error boundary and produce a 500. Aligns behavior with requireSession.
• API-002/003: Added a dedicated "API resource server" section to the README covering requireClaims, getClaims, bearerTokenMiddleware, correct Auth0 Dashboard setup (PKCE user flows require user.policy: allow_all on the resource server — not the M2M Applications tab), and claims.aud string vs string[] handling.

Test plan

• requireClaims with no Authorization header → 401 JSON { error: "bearer_token_error" }
• requireClaims with invalid token → 401 JSON with underlying error message
• requireClaims with missing scope → 403 JSON { error: "insufficient_scope" }
• requireClaimsFromContext with null claims in context → 401 Response
• requireClaimsFromContext with missing scope → 403 Response
• ConfigurationError (missing AUTH0_DOMAIN/AUTH0_AUDIENCE) still propagates as-is (not swallowed)
• All existing tests pass: npm test

[Piyush-85]

LGTM