Move auth-api's project file onto deploy-kit 1.0 #119

What to build

auth-api's project file moves onto deploy-kit 1.0, in one change and one release (JorisJonkers-dev/deploy-kit#380, step 3):

1. Drop observability.alertClass from the auth Application. 1.0 removed it; on 0.31 and 0.32 it is still required, so it can't go earlier. fix(deploy): drop alertClass, which deploy-kit 1.0 removes #116 dropped it too early and revert: keep alertClass until the toolkit is deploy-kit 1.0 #118 reverted it.
2. In deploy/env/auth-api/base.env, VAULT_KUBERNETES_ROLE=auth-api becomes VAULT_KUBERNETES_ROLE=${identity:vaultRole}. On 1.0 a Process holding a delivery: self grant (the transit key auth-api-jwt) must wire its own Vault client, or it is E_SELF_WITHOUT_VAULT_CLIENT. The placeholder exists only from 1.0.

Why it is urgent once 1.0 is out

The estate's Platform document names auth/auth as the public tier's forward-auth provider. Composition on 1.0 parses every held fragment with 1.0's schema, so auth's fragment must be clean before the estate composes on 1.0.

Order

After the Publish Fragment workflow pins 1.0.0 (JorisJonkers-dev/github-workflows#197). Before the estate moves (JorisJonkers-dev/deploy-kit#380).

Check

deploy-kit validate deploy/auth.project.yml deploy/env on 1.0. Together with every other Project's deploy/ and the estate's files, this validated on deploy-kit main e255f846 on 2026-10-27.

Watch: the role ${identity:vaultRole} derives must exist. The estate path's vault-policy job writes it, and auth is on the estate path.