[ramya18101]

🔧 Changes

Closes gaps in auth0 quickstarts setup (qs setup) so agents can use it safely in existing projects.

• Config file safety: qs setup no longer silently overwrites an existing config file.
  • .env files are merged: owned keys are updated or appended, and all other lines and comments are kept.
  • Other formats are backed up to <file>.auth0-backup before replacement.
  • With --no-input or in agent mode, .env is merged and any other existing file needs the new --force flag.
• JSON result: with --json, --json-compact or agent mode, qs setup prints one JSON object on stdout. It holds the app, API, client grant, config file action and path, keys_written (names only) and next_steps. Human text stays off stdout.
• Client-grant scopes: the grant now uses the API's --scopes instead of an empty list. The new --grant-scopes flag grants a subset, and each value must also be in --scopes.
• Multiple URLs: --callback-url, --logout-url and --web-origin-url accept comma-separated or repeated values, which replace the default list.
• Webpack SPAs: added spa:react:webpack and spa:vanilla-javascript:webpack, plus detection from webpack.config.*. The --build-tool help text is now generated from the registered configs, so it no longer lists cra.
• New frameworks: added TanStack Start (regular:tanstack-start:none) and Java servlet MVC (regular:java-mvc:maven and :gradle) with detection. Servlet-only Java projects now resolve to java-mvc instead of java-ee.

🔬 Testing

Unit tests were added or extended in internal/cli/quickstarts_test.go, internal/cli/quickstart_detect_test.go and internal/auth0/quickstarts_test.go.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)