test(examples): runnable anonymous-sessions example + tiered tests

[tusharpandey13]

Summary

Stacked PR (2/2): example + tests. Adds examples/with-anonymous-sessions/, a runnable example consuming the local SDK that demonstrates the full anonymous-session flow. Stacked on top of the SDK implementation PR (auth0#2797); review and merge that one first.

What it demonstrates

• Guest session creation with set-once metadata (a cart id), via createAnonymousSession() behind a POST /api/anon/create route.
• Server Component read (SSR) and live client-hook read (useAnonymousSession()) side by side.
• Login-to-link: an anonymous session present at login is linked to the authenticated user at callback (the demo surfaces anonymousSessionLinked as a ?linked=true banner).
• Logout that clears the anonymous cookie.

Tests

• Unit and MSW: wire-contract and client-hook coverage.
• Browser (Playwright): the session-fixation strip end-to-end and the logout and error-banner UI run without credentials; the live login-to-link callback runs against a tenant test user (pnpm test:e2e).
• Offline mock tier (pnpm test:e2e:offline): 17 deterministic tests covering the full lifecycle (create, read, logout, error-code mappings, renewal, set-once retention) through the real SDK against a mocked Auth0 network hop. No tenant required. It does not prove the real /anonymous/token wire contract; the live tier does.

COVERAGE.md documents the tier-by-tier matrix and disclosed gaps.

Notes

• The offline mock, its scenario-control route, and the env-gated customFetch seam are marked test-only, with a production checklist in the README and a warning in .env.example.
• No real secrets in any spec or fixture (synthetic token-shaped values only).
• Not wired into CI.

[tusharpandey13]

Superseded by auth0#2814 (example, stacked on auth0#2813). Closing.