feat: project detection support added

[KartikJha]

Changes

internal/cli/quickstart_detect.go (new file)

• Added DetectProject(dir string) DetectionResult — scans the working directory for framework signal files and returns a structured result with Framework, Type, BuildTool, Port, AppName, Detected, and AmbiguousCandidates
• Implements 14 detection priority levels covering: Angular, Flutter (web/native), Vite+React/Vue/Svelte/Vanilla, Next.js, Nuxt, SvelteKit, Expo, ASP.NET (.csproj), Java (Spring Boot / Java EE / Vanilla via pom.xml or build.gradle), PHP/Laravel (composer.json), Go (go.mod), Ruby on Rails (Gemfile), Python/Flask (requirements.txt / pyproject.toml), and package.json dep scanning for Express/Fastify/Hono/Ionic/React Native
• Config-file signals (e.g. angular.json, vite.config.ts) take priority over generic dep scanning to avoid false positives
• When multiple package.json deps match, AmbiguousCandidates is populated so the caller can prompt for disambiguation

internal/cli/quickstarts.go

New setup-experimental command flow:

• Added SetupInputs named struct replacing 3x repeated anonymous structs
• Added resolveRequestParams() — resolves DetectionSub placeholders in RequestParams (callbacks, logout URLs, web origins, name) using actual app name and port at runtime
• Integrated DetectProject() into RunE: on an existing project the detected framework/type/build-tool/port/name are shown as a summary and the user is asked to confirm; accepted values pre-fill SetupInputs so downstream prompts are skipped
• Ambiguous detection (multiple package.json deps) triggers a framework disambiguation prompt
• No-detection fallback (empty directory) prompts for all inputs: type -> framework (filtered by type) -> build tool -> port -> name
• getQuickstartConfigKey skips any field already populated (by flags or detection) and only asks for what is missing
• API creation now uses management.ResourceServer + cli.api.ResourceServer.Create() instead of management.Client
• API name defaults to <app-name>-API; API identifier defaults to https://<app-name-slug>
• API-only flow prompts the user to select an existing Auth0 application to associate with
• Registered all spec flags: --app, --api, --name, --type, --framework, --build-tool, --port, --callback-url, --logout-url, --web-origin-url, --identifier, --audience, --signing-alg, --scopes, --token-lifetime, --offline-access

Other fixes applied during review:

• Removed hardcoded RS256 overwrite on API signing algorithm
• Secret fields (e.g. AUTH0_SECRET, SESSION_SECRET) now use generateState(32) instead of a static placeholder
• Map iteration over EnvValues is now sorted for deterministic config file output
• Spring Boot YAML config uses gopkg.in/yaml.v2 with buildNestedMap() to correctly produce nested YAML from dot-delimited keys (e.g. okta.oauth2.issuer)
• All detection-related string literals replaced with the auth0.DetectionSub constant
• Output switched from fmt.Printf to cli.renderer.Infof for consistency
• m2m removed from the application type selection list
• Fixed "::none" error when only --api was selected (config key lookup now correctly skipped for API-only flows)
• Trailing periods removed from section comment dividers in internal/auth0/quickstart.go

---

References

• DXCDT-1554 — review comment fixes for setup-experimental
• DXCDT-1555 — tool detection module and CLI flow refinement

---

Testing

Manual — existing project:

cd /path/to/react-vite-project
auth0 quickstarts setup-experimental
# Expected: detects react/spa/vite/5173, shows summary, confirms, skips re-prompting those fields

Manual — empty directory:

mkdir empty-test && cd empty-test
auth0 quickstarts setup-experimental
# Expected: no detection panel, prompts for type -> framework -> build tool -> port -> name

Manual — API-only:

auth0 quickstarts setup-experimental --api --identifier https://my-api
# Expected: prompts to select an existing app, creates ResourceServer, no app client created

Manual — App + API:

auth0 quickstarts setup-experimental --app --api --name "My App"
# Expected: creates client, creates ResourceServer named "My App-API"

Unit tests for DetectProject covering each of the 14 signal rules: N/A (to be added in a follow-up — mocking os.ReadFile / os.Stat for the full matrix is tracked separately).

---

Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (command --help text and flag descriptions updated inline)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 60.00000% with 446 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.20%. Comparing base (55b66e5) to head (f1e4130).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/cli/quickstarts.go	43.27%	369 Missing and 15 partials ⚠️
internal/cli/quickstart_detect.go	90.38%	32 Missing and 8 partials ⚠️
internal/prompt/prompt.go	0.00%	11 Missing ⚠️
internal/cli/cli.go	0.00%	6 Missing ⚠️
internal/display/display.go	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1476      +/-   ##
==========================================
+ Coverage   59.14%   59.20%   +0.05%     
==========================================
  Files         120      121       +1     
  Lines       21194    22308    +1114     
==========================================
+ Hits        12535    13207     +672     
- Misses       7841     8261     +420     
- Partials      818      840      +22     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ramya18101]

@KartikJha , Please fix the linters errors