feat: add guardian MFA settings, anonymous sessions support, and email factor client

[fern-api]

Breaking Changes ⚠️

• OrganizationTemplates client removed: management.organization_templates is deleted along with ListOrganizationTemplatesPaginatedResponseContent and OrganizationTemplateAssignedOrganization. The module was exported from auth0.management, so direct imports break. The remaining OrganizationTemplate and related enum/policy types stay in place.
• Connection enum member updates: Four providers dropped the -mcp suffix (asana-mcp becomes asana, atlassian-mcp becomes atlassian, gitlab-mcp becomes gitlab, slack-mcp becomes slack). Nine values are removed entirely (docusign-mcp, figma-mcp, gusto-mcp, heroku-mcp, intercom-mcp, pagerduty-mcp, supabase-mcp, vercel-mcp, xero-mcp). notion-mcp, cloudflare-mcp, hubspot-mcp, linear-mcp, and sentry-mcp keep the suffix. Both types are Union[Literal[...], Any], so the SDK does not raise at runtime on old string values, but the Auth0 API will reject them server-side. Code that passes old literal strings or annotates variables with ConnectionStrategyEnum must be updated. Static type checkers will flag the removed members.

Added

• Guardian settings: new management.guardian.get() and management.guardian.set(display_remember_me_checkbox, remember_me_default_value, mfa_session_inactivity_timeout, mfa_session_overall_timeout) calling GET/PUT /api/v2/guardian/settings. Response type GetGuardianSettingsResponseContent / SetGuardianSettingsResponseContent.
• Email MFA factor: new management.guardian.factors.email sub-client with get() and set(otp_length, otp_expiration_time) calling GET/PUT /api/v2/guardian/factors/email/settings. Response types GetEmailFactorSettingsResponseContent / SetEmailFactorSettingsResponseContent.
• Phone factor settings: new management.guardian.factors.phone.get() and set(otp_length, otp_expiration_time) calling GET/PUT /api/v2/guardian/factors/phone/settings, in addition to the existing message type, provider, and template operations. Response types GetPhoneFactorSettingsResponseContent / SetPhoneFactorSettingsResponseContent.
• Organizations search: new management.organizations.search(...) calling GET /api/v2/organizations/search with paginated results. New types: SearchOrganization, SearchOrganizationsPaginatedResponseContent, OrganizationSortFieldEnum.
• Resource servers search: new management.resource_servers.search(...) calling GET /api/v2/resource-servers/search with search parameters. New types: SearchResourceServersResponseContent, ResourceServerSearchResponse, ResourceServerSortFieldEnum, ResourceServerSubjectTypeAuthorization.
• Experimentation client: new experimentation sub-client exposing experiments.advance_ramp(...). It is reachable on the generated Auth0 / AsyncAuth0 management client, not on the ManagementClient facade, so management.experimentation is not available.
• Anonymous sessions on clients: POST and PATCH /api/v2/clients accept a new anonymous_sessions field (CreateAnonymousSessions / UpdateAnonymousSessions, required field active: bool). GET /api/v2/clients/{id} response exposes anonymous_sessions: Optional[AnonymousSessions].
• Anonymous sessions on tenant settings: PATCH /api/v2/tenants/settings accepts sessions.anonymous (TenantSettingsSessionsAnonymous) with optional fields lifetime_in_minutes (int) and activate_cookie (bool).
• Resource server anonymous access: POST and PATCH /api/v2/resource-servers accept token_lifetime_for_anonymous_access_tokens: Optional[int] and subject_type_authorization.anonymous_user.policy (enum deny_all / require_client_grant).
• GatewayTimeoutError: new error type raised on HTTP 504 responses.