Core app reliability — auth, session management, gateway, .databricksignore

Summary

Bundle of reliability fixes that have been sitting in datasciencemonkey PR #138:

• Case-insensitive email auth — Databricks SSO headers can deliver mixed-case email; current strict comparison locks legitimate users out.
• 30-char app-name truncation — long app names break the databricks apps get lookup and the deploy script silently fails.
• AI Gateway auto-discovery from DATABRICKS_WORKSPACE_ID with reachability probe before use; fall back to direct serving endpoints if unreachable.
• MAX_CONCURRENT_SESSIONS cap (default 5) to prevent resource exhaustion on a single-container app.
• Fresh proxy token on PAT rotation — currently emits 401s until the next app restart.
• app_state.py — lightweight persistence for owner + last rotation under ~/.coda/.
• .databricksignore — exclude .venv/ and caches from databricks sync (huge upload otherwise).

Branch

fix/core-app-reliability — about to be pushed to this repo.

Diff scope

+1982 / -429, 22 files; new tests for gateway discovery, session limit, clipboard addon.

Notes

• Bundled because the fixes touch overlapping surface area (auth, session lifecycle, gateway routing) and tests were written holistically. Splitting into per-fix PRs would force ugly test reshuffles.
• Hadn't migrated when the repo moved here from datasciencemonkey.

The existing fix is described in datasciencemonkey PR #138 and branch fix/core-app-reliability; review that diff first, including app_state.py and .databricksignore. Run the new gateway-discovery, session-limit, and clipboard-addon tests to understand the current coverage. Done means the listed auth, naming, gateway, session, token, persistence, and sync behaviors are covered in this repository and the relevant tests pass.