Core app reliability — auth, session management, gateway, .databricksignore

[dgokeeffe]

Summary

Bundle of reliability fixes that have been sitting in datasciencemonkey PR #138:

• Case-insensitive email auth — Databricks SSO headers can deliver mixed-case email; current strict comparison locks legitimate users out.
• 30-char app-name truncation — long app names break the databricks apps get lookup and the deploy script silently fails.
• AI Gateway auto-discovery from DATABRICKS_WORKSPACE_ID with reachability probe before use; fall back to direct serving endpoints if unreachable.
• MAX_CONCURRENT_SESSIONS cap (default 5) to prevent resource exhaustion on a single-container app.
• Fresh proxy token on PAT rotation — currently emits 401s until the next app restart.
• app_state.py — lightweight persistence for owner + last rotation under ~/.coda/.
• .databricksignore — exclude .venv/ and caches from databricks sync (huge upload otherwise).

Branch

fix/core-app-reliability — about to be pushed to this repo.

Diff scope

+1982 / -429, 22 files; new tests for gateway discovery, session limit, clipboard addon.

Notes

• Bundled because the fixes touch overlapping surface area (auth, session lifecycle, gateway routing) and tests were written holistically. Splitting into per-fix PRs would force ugly test reshuffles.
• Hadn't migrated when the repo moved here from datasciencemonkey.