feat: add mfa.stepUpWithPopup() for reactive MFA step-up via Universal Login

[tusharpandey13]

Adds client-side mfa.stepUpWithPopup() that completes MFA step-up in a popup window using Auth0 Universal Login, without a full-page redirect.

How it works: When getAccessToken() throws MfaRequiredError, the app calls mfa.stepUpWithPopup({ audience }). A popup opens, the user completes MFA, and the resulting token is cached in the session and returned to the caller.

Changes

• Added mfa.stepUpWithPopup() to client helpers
• Added challengeMode?: "redirect" | "popup" to StartInteractiveLoginOptions
• Added popup mode handling to handleCallback()
• Updated getTokenSet, handleAccessToken to enable conditional scope merging
• Added tests for all flows
• Updated EXAMPLES.md with clear documentation.

Usage

try {
  const token = await getAccessToken({ audience: 'https://api.example.com' });
} catch (err) {
  if (err instanceof MfaRequiredError) {
    // Trigger popup MFA step-up
    const { token } = await mfa.stepUpWithPopup({
      audience: 'https://api.example.com'
    });
  }
}

[gyaneshgouraw-okta]

@copilot Review changes in this PR

[gyaneshgouraw-okta]

The PR in general looks well structured. Have added few minor comments.

[nandan-bhat]

LGTM