[ExtraToast]

Summary

authz-model is legacy auth-api's vocabulary (ROLE_ and SERVICE_ authorities and host gates). identity's Principal contract replaces it, and every language now has an adapter for that contract (#15, spec JorisJonkers-dev/identity#105, Epic JorisJonkers-dev/identity#114). This pull request marks authz-model deprecated everywhere a consumer would look:

• README. A deprecation banner names the replacement: the Principal contract read through each language's adapter, plus the App Roles deploy-kit generates. It has a table of the five adapters.
• Generated code. The generator now marks every Kotlin top-level class and object @Deprecated, and every TypeScript export /** @deprecated */, each with the same pointer. A consumer gets a compiler warning or a strike-through in the editor.
• Package metadata. The npm description and the Maven POM description both start with "Deprecated:". The GitHub repository description now says the same.

The feat: commit makes release-please cut 0.3.0, so the published packages carry the deprecation.

Remaining consumers

None in code. I searched the local estate and GitHub code search for authz-model, dev.jorisjonkers:authz-model, dev.jorisjonkers.authz and @jorisjonkers-dev/authz-model. Only references to the repository itself remain, and none of them depends on the packages:

• workspace. scripts/enable-gradle-composite.sh and docs/contract-chains.md include it in the Gradle composite build, and .gitmodules and the README list it as a submodule.
• home-portal. src/features/home/data/projects.ts and docs/estate-project-overview-design.md list it as a project.
• .github and study-platform. The org profile READMEs list it.

These go when the repository is archived, which is the last step of the ticket.

Checks

• npm run validate, check:generated, lint, format:check and typecheck pass.
• ./gradlew check passes, so the Kotlin package and its tests still compile with the deprecations in place.

Part of #15. The archive itself follows once this release is out.