fix: enforce owner auth on session endpoints + case-insensitive email

[datasciencemonkey]

Summary

• Security fix: Remove /api/sessions and /api/session/attach from auth exemption list — non-owners could list sessions and read terminal output (fixes Security: session endpoints bypass owner authorization check #132)
• Case-insensitive email matching: Normalize all emails to lowercase at ingestion points so SSO header casing differences don't cause auth failures
• AI Gateway probe: Auto-discovered gateway URLs are checked for reachability before use; unreachable gateways fall back gracefully

What changed

File	Change
app.py	Remove session endpoints from auth exemption list; lowercase emails in get_token_owner(), get_request_user(), WS auth
utils.py	Gateway URL probe with 2s timeout + _GATEWAY_RESOLVED caching
tests/test_auth_enforcement.py	17 new tests — endpoint auth enforcement + case-insensitive email matching
tests/test_gateway_discovery.py	Updated gateway probe tests
tests/test_session_limit.py	Session limit enforcement tests
tests/test_clipboard_addon.py	Clipboard addon tests
static/index.html	Session management UI, clipboard support, rendering fixes

Security checklist

• /api/sessions (GET) denies non-owners with 403
• /api/session/attach (POST) denies non-owners with 403
• /api/session (POST create) denies non-owners with 403
• /api/session/close (POST) denies non-owners with 403
• /api/resize (POST) denies non-owners with 403
• All 5 endpoints allow the owner through
• WebSocket connect denies non-owners (existing coverage)
• Fail-closed when app_owner is None on Databricks Apps
• Fail-closed when no identity headers on Databricks Apps
• Case-insensitive: Owner@Databricks.COM matches owner@databricks.com
• Case-insensitive: OWNER@DATABRICKS.COM matches owner@databricks.com
• get_request_user() returns lowercase
• get_token_owner() returns lowercase from both Apps API and PAT paths

Test plan

• tests/test_auth_enforcement.py — 17 tests (endpoint auth + case-insensitive)
• tests/test_ws_authorization.py — 16 tests (WS auth parity)
• tests/test_app_state.py — 8 tests (owner persistence)
• All 41 auth-related tests passing
• Deploy to staging and verify session list/attach/create work for app owner
• Verify a different Databricks user gets 403 on all session endpoints
• Verify SSO with mixed-case email can access the app