fix: core app reliability — auth, session management, gateway, .databricksignore

[dgokeeffe]

Priority

P2 — multiple latent reliability fixes (case-insensitive auth, gateway auto-discovery, session-limit cap, fresh-token-on-rotation). Bundled because the fixes share auth/session/gateway surface area and tests were written holistically. Note in PR body: requirements.lock and requirements.txt should be regenerated from pyproject.toml via uv lock && uv pip compile before merge — they were taken whole-cloth from main during rebase rather than manually merged.

---

Summary

Migrates datasciencemonkey PR #138 to the new repo home, rebased onto databrickslabs/main.

Bundle of reliability fixes:

• Case-insensitive email auth — Databricks SSO headers can deliver mixed-case email; current strict comparison locks legitimate users out.
• 30-char app-name truncation fix — long app names break the databricks apps get lookup and the deploy script silently fails.
• AI Gateway auto-discovery from DATABRICKS_WORKSPACE_ID with reachability probe before use; falls back to direct serving endpoints if unreachable.
• MAX_CONCURRENT_SESSIONS cap (default 5) to prevent resource exhaustion on a single-container app.
• Fresh proxy token on PAT rotation — currently emits 401s until the next app restart.
• Owner resolution: 6-attempt retry with exponential backoff for SP propagation delay; supports the spawner pattern (description: "owner:{email}").
• app_state.py — lightweight persistence for owner + last rotation under ~/.coda/.
• .databricksignore — exclude .venv/ and caches from databricks sync (huge upload otherwise).

Rebase notes

10 conflicts resolved against current main:

• Trivial / kept main's version — .gitignore (codex/.agents ignores), Makefile (.PHONY includes test), app.yaml (databricks-gpt-5-5, dropped redundant MLFLOW_CLAUDE_TRACING_ENABLED since feat: MLflow tracing with async Stop hook (opt-in) #15 owns that), pyproject.toml (kept v0.18.1 + cryptography 46.0.7), GH workflow files (commit-pinned setup-uv, databrickslabs-protected-runner-group), tests/test_session_limit.py (kept main's session-clear test isolation).
• requirements.txt + requirements.lock — took main's versions (27 conflict blocks total in auto-generated lock files; not worth manual merge). TODO: regenerate via uv lock && uv pip compile pyproject.toml -o requirements.txt before merge if any new deps from this branch aren't transitively included.
• app.py (4 blocks):
  1. Settings.json write in _configure_all_cli_auth: kept main's read-merge-write (PR #153 race fix). Branch's full-overwrite was redundant — theme/permissions set by setup_claude.py at startup are preserved naturally by the merge pattern.
  2. Owner resolution loop: combined branch's 6-retry + description-fallback structure with main's set_product_info(w) telemetry call.
  3. PAT-fallback owner: kept main's set_product_info(w) after WorkspaceClient(...).
  4. Shell env strip: kept main's GEMINI_API_KEY pop (so Gemini reads from config, not stale env after rotation).

Test plan

• uv run pytest tests/ --ignore=tests/gates — 184 should pass
• tests/test_gateway_discovery, test_session_limit, test_clipboard_addon exercise the new behaviour
• Deploy to a daveok / dogfood instance, verify setup completes and databricks apps get coding-agents returns OK (no 30-char truncation)
• Mixed-case email (User@Company.com) authorises correctly
• Confirm .venv/ absent from workspace after databricks sync
• Regenerate requirements.lock + requirements.txt from pyproject.toml before merge if any new deps need pinning

Closes #10

This pull request and its description were written by Isaac.