Log Auth0 client IDs in Cloud Run gateway request logs

[anth-volk]

Fixes #1649

Summary

• share the existing Auth0 JWT validator through an optional lightweight auth extra
• validate gateway bearer tokens and normalize Auth0 client_id, azp, or machine-to-machine sub claims
• add auth0_client_id only to the Cloud Run gateway's canonical request-completion log
• refresh cached Auth0 JWKS safely on expiry or an unfamiliar key ID, with per-issuer single-flight fetching and bounded retries
• pass the existing Auth0 domain and audience from PolicyEngine's staging and production workflows while keeping generic/local deploys optional
• document a Cloud Logging query for client-specific requests and future latency analysis

Why

Gateway logs already contain request ID, route, status, duration, and backend, but the gateway previously only forwarded bearer tokens and had no trusted application client ID to record. Using the generic observability setter would also have promoted the high-cardinality value into tracing, so this change adds a log-only request-context path.

Attribution is best effort and never changes routing or the worker's authoritative authentication decision. Invalid or unavailable attribution omits the field, and bearer tokens and authorization headers are never logged.

JWKS successes are cached for five minutes and refreshed when stale or when a JWT identifies a key absent from the cached set. Concurrent cold-cache or forced refreshes share one outbound request per issuer; refresh failures retain the last known-good set, and successful or failed attempts impose a 30-second minimum retry interval.

PolicyEngine's staging and production deploy jobs provide AUTH0_ADDRESS_NO_DOMAIN and AUTH0_AUDIENCE_NO_DOMAIN from repository secrets, and a workflow-level test pins that contract. The generic deploy wrapper omits either variable when unset so local and third-party deployments remain usable without Auth0 configuration.

Validation

• uv run pytest -q tests/unit/auth/test_validation.py — 41 passed
• uv run pytest -q .github/scripts/test_cloud_run_deploy_failover.py .github/scripts/test_deploy_staged_workflow.py — 14 passed
• make test — 755 passed, 1 skipped
• make test-with-auth — 7 passed
• make test-analytics-isolated — 7 passed; Authlib/Joserfc remained outside the writer closure
• make format-check — passed
• targeted Ruff checks, bash -n, and git diff --check — passed
• uv lock --check — passed
• bash .github/scripts/check-changelog-fragment.sh — passed