Improve DX : remove useEphemeralSession() and expose asProvider() publicly

[sanchitmehtagit]

Summary

Removes the useEphemeralSession() method and exposes WebAuthentication.asProvider(ephemeralSession:) as public API to resolve a critical API design flaw where mutually exclusive methods could be used together.

Problem

The Web Auth builder allowed calling mutually exclusive methods without warning:

Auth0
    .webAuth()
    .useEphemeralSession()  // Sets internal flag
    .provider(WebAuthentication.safariProvider())  // Overrides provider completely
    .start { }

Result: The ephemeral session configuration is silently ignored. No compiler error, no runtime warning—just unexpected behavior that's difficult to debug.

Solution

Remove useEphemeralSession() and expose the default provider explicitly:

// Before (v2)
Auth0.webAuth().useEphemeralSession().start { }

// After (v3)
Auth0.webAuth().provider(WebAuthentication.asProvider(ephemeralSession: true)).start { }

Why This Matters

1. Type Safety - Impossible to configure conflicting options
2. Explicit Intent - Code is self-documenting
3. Consistency - Matches pattern used by safariProvider()
4. Discoverability - Users see asProvider() in autocomplete alongside other providers

Changes

• Removed useEphemeralSession() from WebAuth protocol and Auth0WebAuth
• Exposed WebAuthentication.asProvider(ephemeralSession:) as public API
• Updated all documentation (EXAMPLES.md, FAQ.md, UserAgents.md)
• Added comprehensive migration guide entry
• Cleaned up tests