feat(examples): add stateful (server-side) sessions example

[frederikprijck]

Summary

Adds a new self-contained example, example-express-stateful-sessions, demonstrating how to use a custom server-side session store with @auth0/auth0-express.

By default the SDK is stateless — the whole session is encrypted into the cookie. Passing a sessionStore to createAuth0 switches to a stateful session: the session data (authenticated user + tokens) is persisted server-side and the cookie only carries an encrypted reference to it.

• src/session-store.ts — InMemorySessionStore implements SessionStore<StoreOptions> (a Map), implementing get / set / delete / deleteByLogoutToken. Comments call out that it's illustrative and would be Redis/DB in production.
• src/index.ts — wires the store via createAuth0({ sessionStore }) and protects /private with the SDK's requiresAuth().

Tests

Follows the existing example-express-mcd pattern (MSW + supertest):

• src/session-store.spec.ts — unit-tests the store directly: set/get round-trip, delete, and deleteByLogoutToken matching on sub and sid (plus a non-match leaves sessions intact).
• src/index.spec.ts — mocks Auth0 discovery, JWKS, and the token endpoint (signing a real RS256 ID token with jose), drives a full mocked login (/auth/login → /auth/callback), and asserts:
  • the store grows by exactly one entry and that entry holds the real session data (user.sub), proving the session lives server-side;
  • a session cookie is still set (an encrypted reference, not the session itself);
  • the persisted session grants access to /private.

CI

Adds a Stateful Sessions job to .github/workflows/examples.yml running build + test:ci, mirroring the other per-example jobs.

Verification

npm run build -w @auth0/auth0-express && npm run build -w example-express-stateful-sessions && npm run test:ci -w example-express-stateful-sessions — build clean, 8/8 tests passing.