fix: remove Auth0Server dependency from getClaims and requireClaims

[yogeshchoudhary147]

Summary

• getClaims and requireClaims no longer require a full Auth0Server config
• verifyJwt now reads AUTH0_DOMAIN and AUTH0_AUDIENCE directly from env vars instead of calling getInstance(), which triggered the full session config validation
• API-only deployments now only need two env vars instead of five

Before this fix, a developer using only requireClaims was forced to set AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SESSION_SECRET, and AUTH0_APP_BASE_URL — none of which are used during JWT verification.

Test plan

• requireClaims / getClaims work with only AUTH0_DOMAIN + AUTH0_AUDIENCE set
• ConfigurationError thrown when AUTH0_DOMAIN is missing
• ConfigurationError thrown when AUTH0_AUDIENCE is missing
• Full SSR session flow unaffected
• npx vitest run — all 320 tests pass