style: fix repo convention violations flagged in PR review

- Replace em dash with plain hyphen in test_mfa_client.py section header
- Split semicolon clause-splices into two sentences in MutualTLS.md (x2),
  server_client.py comment, and MfaVerifyError message
- Restructure _resolve_token_endpoint docstring with Returns:/Raises: sections

Author: cschetan77

examples/MutualTLS.md

@@ -1,6 +1,6 @@
 # Mutual TLS (mTLS) Client Authentication
 
-Authenticate to Auth0 with a TLS client certificate instead of a client secret (RFC 8705). The certificate is presented during the TLS handshake; no credential travels in the request body.
+Authenticate to Auth0 with a TLS client certificate instead of a client secret (RFC 8705). The certificate is presented during the TLS handshake. No credential travels in the request body.
 
 ## Prerequisites
 
@@ -53,7 +53,7 @@ The SDK passes `ssl_context` as `verify=ssl_context` to every `httpx.AsyncClient
 |-----------|--------|
 | `client_secret` | One client-auth method only - Auth0 rejects requests carrying both. |
 | `client_assertion_signing_key` | Same - one method only. |
-| `dpop_key` (per-call on `signin_with_passkey` / `mfa.verify`) | DPoP binds to its own key (`cnf.jkt`) and suppresses `cnf.x5t#S256`; combining them silently defeats mTLS token binding. |
+| `dpop_key` (per-call on `signin_with_passkey` / `mfa.verify`) | DPoP binds to its own key (`cnf.jkt`) and suppresses `cnf.x5t#S256`. Combining them silently defeats mTLS token binding. |
 
 All three raise `ConfigurationError` immediately (constructor for the first two, at the call site for DPoP).
 

src/auth0_server_python/auth_server/server_client.py

@@ -298,8 +298,12 @@ async def _resolve_mfa_token_endpoint(self, store_options) -> str:
     def _resolve_token_endpoint(self, metadata: dict) -> Optional[str]:
         """Return the token endpoint, routed to the mTLS alias when mTLS is enabled.
 
-        Under mTLS, raises ConfigurationError immediately if the alias is absent.
-        Under standard auth, returns None if token_endpoint is missing (caller's guard handles it).
+        Returns:
+            The token endpoint URL, or None if not present and mTLS is not enabled.
+
+        Raises:
+            ConfigurationError: If mTLS is enabled but the discovery document does not
+                advertise mtls_endpoint_aliases.token_endpoint.
         """
         if self._use_mtls:
             aliases = metadata.get("mtls_endpoint_aliases") or {}
@@ -353,7 +357,7 @@ def _apply_client_authentication(
 
         if self._use_mtls:
             # The client certificate presented in the TLS handshake is the sole
-            # credential; no body credential or HTTP basic auth is sent.
+            # credential. No body credential or HTTP basic auth is sent.
             return None
 
         if self._client_assertion_signing_key:
@@ -1084,7 +1088,7 @@ async def _establish_session_from_mfa_verify_response(
         id_token = token_response.get("id_token")
         if not id_token:
             raise MfaVerifyError(
-                "MFA verification response did not include an ID token; cannot create a session"
+                "MFA verification response did not include an ID token. Cannot create a session."
             )
 
         origin_domain = await self._resolve_current_domain(store_options)

src/auth0_server_python/tests/test_mfa_client.py

@@ -1097,7 +1097,7 @@ async def mock_post(self_client, url, **kwargs):
 
 
 # ============================================================================
-# mTLS — MfaClient SSLContext threading + DPoP exclusion + endpoint override
+# mTLS - MfaClient SSLContext threading + DPoP exclusion + endpoint override
 # ============================================================================