fix: restore SPA session on page refresh using refresh tokens and localstorage cache

[yogeshchoudhary147]

Problem

In SPA mode, authentication state was lost on every page refresh because:

1. auth0-spa-js defaults to in-memory token storage — cleared on page refresh
2. The hidden iframe silent auth fallback relies on third-party cookies, which modern browsers block by default

This caused users to be redirected to login on every page refresh or full-page navigation.

Fix

• Default useRefreshTokens to true — uses refresh tokens instead of the blocked iframe approach
• Default cacheLocation to localstorage — refresh token survives page refresh
• Call getTokenSilently() during provider init to restore the session from the stored refresh token on remount

Both options are overridable via env vars for apps with stricter security requirements:

• VITE_AUTH0_USE_REFRESH_TOKENS=false to disable refresh tokens
• VITE_AUTH0_CACHE_LOCATION=memory to opt into in-memory only storage

Auth0 dashboard requirements

• Allow Offline Access must be enabled on the API to issue refresh tokens
• Allowed Web Origins must include the app origin