feat(eval): add spa-js DPoP token binding eval

[yogeshchoudhary147]

Summary

• Adds a new dpop/spa-js eval that measures how well agents add DPoP token binding to a vanilla JS SPA using @auth0/auth0-spa-js
• Adds scaffolds/spa-js/auth0 — a working Auth0 SPA scaffold (generated from the spa_js_quickstart eval) that agents build on top of
• Graders cover useDpop: true config, createFetcher/fetchWithAuth usage, no manual crypto, and correct Authorization: DPoP header behaviour

Test plan

• npm run build passes
• npm test passes
• npm run evals -- --eval spa_js_dpop --mode baseline runs and scores graders