feat: add universal-portals setup command (Beta)

[jacobovidal]

Description:

🔧 Changes

Adds auth0 universal-portals setup (alias: auth0 up setup) as a new top-level command that provisions all Auth0 resources required by a Universal Portals application in a single step:

• Resource servers (idempotent — skips silently if already exists):
  • Auth0 My Account API (https://<tenant>/me/)
  • Auth0 My Organization API (https://<tenant>/my-org/)
• Regular Web App client with refresh token policies, session transfer, and OIDC backchannel logout configured
• Three client grants with the correct subject_type per audience (My Account/My Org APIs → user, Management API → client)

The portal domain is resolved automatically: uses the tenant's default custom domain if one is active, otherwise falls back to the tenant domain. Client ID is rendered as a clickable OSC8 hyperlink to the Management Dashboard. After setup, the portal URL is shown and optionally opened in the browser.

Raw HTTP is used for client and grant creation because session_transfer, refresh_token.policies, and subject_type are absent from the vendored go-auth0 SDK.

⚠️ Form and Portal provisioning are not yet implemented (TODOs in place — payloads TBD).

📚 References

• TBC

🔬 Testing

Requires an active Auth0 CLI session (auth0 login) on a beta-enabled tenant.

# Interactive
auth0-beta up setup

# Non-interactive
auth0-beta up setup --name "My Portal"
auth0-beta universal-portals setup -n "My Portal"

Expected output:

1. Domain line (custom or tenant)
2. Name prompt (skipped if --name provided)
3. ✓ / (already exists) for each resource server
4. ✓ Application created with masked client secret and clickable client ID
5. ✓ for each of the three client grants
6. Portal URL + "Press Enter" to open in browser

Re-running the command should not fail — resource servers return (already exists).

Note: make docs is blocked by a local vendor/modules.txt inconsistency unrelated to this change; docs will regenerate in CI.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)