Replace legacy password/YAML login with Databricks Apps identity (v1.10.0)

[forrestmurray-db]

Summary

Remove the legacy "production login" (email+password + YAML facilitator bootstrap) and delegate identity to Databricks Apps. Access is already gated by Databricks Apps; the app-layer login only mapped users to roles and gated facilitator bootstrap behind a plaintext password in config/auth.yaml.

Verified mechanism (Databricks Apps user authorization)

• Facilitator = CAN_MANAGE on the app, detected via apps.get_permissions over the user's OBO token (x-forwarded-access-token). This requires the app to declare user_api_scopes: ["apps"] — NOT a default scope. Verified live on a Databricks App: without the scope, every user including admins fails the scope gate (403 ... required scopes: access-management) and resolves to SME; with the scope + restart, get_permissions succeeds and returns the caller's CAN_MANAGE. Confirmed with the Databricks Apps team and against the SDK/docs.
• Everyone else who can reach the app = regular user (SME). No positive CAN_USE check needed — reaching the app already means Databricks granted access. get_permissions is purely a facilitator probe.
• Workshop membership comes from the facilitator's existing invitation/participant flow ("added by the facilitator → they're in").
• CAN_MANAGE can be granted directly or via a group → the provider must match both.

Scope of work

• Backend: port provider-resolved auth (server/features/auth/*) from commit 9a50539, stripping its V2 project-setup dependency; add GET /api/auth/session; harden role resolution — group-grant matching, fail-loud on missing-scope/misconfig (vs. silent SME demotion), no caching of fallback roles.
• Remove: POST /users/auth/login, facilitator-config CRUD, config/auth.yaml, server/utils/password.py, server/utils/config.py; migration to drop users.password_hash + facilitator_configs.
• Frontend: keep the existing workshop-selection flow + workshop_id scoping; drop the email/password inputs; source identity from /api/auth/session.
• Specs (protected): rewrite the "Login by Role" criteria in ROLE_PERMISSIONS_SPEC and the endpoint/backwards-compat sections in AUTHENTICATION_SPEC.

Deploy requirement

App must declare user_api_scopes: ["apps"] and be restarted; DATABRICKS_APP_NAME set; facilitators hold CAN_MANAGE (direct or via group).

Plan

See .claude/plans/2026-06-17-databricks-apps-auth-port.md. Implementation on branch feat/databricks-apps-auth (based on rc/v1.10.0).

Note

Plan was drafted reading main; on rc/v1.10.0, database_service.py, models.py, database.py, AUTHENTICATION_SPEC.md, and ROLE_PERMISSIONS_SPEC.md differ — file/line references and quoted success criteria must be re-validated against the release branch before implementing.