feat: project detection support added

[KartikJha]

Changes

internal/cli/quickstart_detect.go (new file)

• Added DetectProject(dir string) DetectionResult — scans the working directory for framework signal files and returns a structured result with Framework, Type, BuildTool, Port, AppName, Detected, and AmbiguousCandidates
• Implements 14 detection priority levels covering: Angular, Flutter (web/native), Vite+React/Vue/Svelte/Vanilla, Next.js, Nuxt, SvelteKit, Expo, ASP.NET (.csproj), Java (Spring Boot / Java EE / Vanilla via pom.xml or build.gradle), PHP/Laravel (composer.json), Go (go.mod), Ruby on Rails (Gemfile), Python/Flask (requirements.txt / pyproject.toml), and package.json dep scanning for Express/Fastify/Hono/Ionic/React Native
• Config-file signals (e.g. angular.json, vite.config.ts) take priority over generic dep scanning to avoid false positives
• When multiple package.json deps match, AmbiguousCandidates is populated so the caller can prompt for disambiguation

internal/cli/quickstarts.go

New setup-experimental command flow:

• Added SetupInputs named struct replacing 3x repeated anonymous structs
• Added resolveRequestParams() — resolves DetectionSub placeholders in RequestParams (callbacks, logout URLs, web origins, name) using actual app name and port at runtime
• Integrated DetectProject() into RunE: on an existing project the detected framework/type/build-tool/port/name are shown as a summary and the user is asked to confirm; accepted values pre-fill SetupInputs so downstream prompts are skipped
• Ambiguous detection (multiple package.json deps) triggers a framework disambiguation prompt
• No-detection fallback (empty directory) prompts for all inputs: type -> framework (filtered by type) -> build tool -> port -> name
• getQuickstartConfigKey skips any field already populated (by flags or detection) and only asks for what is missing
• API creation now uses management.ResourceServer + cli.api.ResourceServer.Create() instead of management.Client
• API name defaults to <app-name>-API; API identifier defaults to https://<app-name-slug>
• API-only flow prompts the user to select an existing Auth0 application to associate with
• Registered all spec flags: --app, --api, --name, --type, --framework, --build-tool, --port, --callback-url, --logout-url, --web-origin-url, --identifier, --audience, --signing-alg, --scopes, --token-lifetime, --offline-access

Other fixes applied during review:

• Removed hardcoded RS256 overwrite on API signing algorithm
• Secret fields (e.g. AUTH0_SECRET, SESSION_SECRET) now use generateState(32) instead of a static placeholder
• Map iteration over EnvValues is now sorted for deterministic config file output
• Spring Boot YAML config uses gopkg.in/yaml.v2 with buildNestedMap() to correctly produce nested YAML from dot-delimited keys (e.g. okta.oauth2.issuer)
• All detection-related string literals replaced with the auth0.DetectionSub constant
• Output switched from fmt.Printf to cli.renderer.Infof for consistency
• m2m removed from the application type selection list
• Fixed "::none" error when only --api was selected (config key lookup now correctly skipped for API-only flows)
• Trailing periods removed from section comment dividers in internal/auth0/quickstart.go

---

References

• DXCDT-1554 — review comment fixes for setup-experimental
• DXCDT-1555 — tool detection module and CLI flow refinement

---

Testing

Manual — existing project:

cd /path/to/react-vite-project
auth0 quickstarts setup-experimental
# Expected: detects react/spa/vite/5173, shows summary, confirms, skips re-prompting those fields

Manual — empty directory:

mkdir empty-test && cd empty-test
auth0 quickstarts setup-experimental
# Expected: no detection panel, prompts for type -> framework -> build tool -> port -> name

Manual — API-only:

auth0 quickstarts setup-experimental --api --identifier https://my-api
# Expected: prompts to select an existing app, creates ResourceServer, no app client created

Manual — App + API:

auth0 quickstarts setup-experimental --app --api --name "My App"
# Expected: creates client, creates ResourceServer named "My App-API"

Unit tests for DetectProject covering each of the 14 signal rules: N/A (to be added in a follow-up — mocking os.ReadFile / os.Stat for the full matrix is tracked separately).

---

Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (command --help text and flag descriptions updated inline)