Release: backend 0.10.0, frontend 0.2.0 (auth)

[jcschaff]

Summary

Version bumps only — no functional change. Cuts the first release since
backend-v0.9.2 / frontend-v0.1.1 (2026-07-29), covering a month of work on
main.

Both services move together because the headline change, Auth0 authentication
(#96), spans both: a backend that verifies bearer tokens and gates
cancel/delete on owner-or-admin, and a frontend that can actually obtain a
token. Shipping one without the other is broken in both directions.

Service	0.9.2 / 0.1.1 →	Files
backend	0.10.0	version.py, pyproject.toml, uv.lock
frontend	0.2.0	package.json, package-lock.json

Minor rather than patch on both: auth is a feature, not a fix. The frontend bump
was done with npm version minor by hand — bump-frontend.sh only does patch.

What ships

Backend 0.10.0

• Auth0-Integration #96 — Auth0 authn/authz: JWKS/RS256 bearer verification, require_roles /
  require_owner_or_admin, /api/v1/me, Keycloak-backed tests.
• fix: resolve OMEX manifest locations written with a "./" prefix #90 — OMEX manifest locations written with a ./ prefix now resolve.
• feat: sort eligible_simulators versions newest-first #91 — eligible_simulators versions sorted newest-first.
• Fix for simulations not starting after an OMEX upload.

Frontend 0.2.0

• Auth0-Integration #96 — login / signup / forgot-password, auth menu, route middleware.
• Fix/minor qol fixes #95 — QOL batch: chart edit UI, log syntax highlighting, description
  truncation, random pre-filled run names.
• Missing NUXT_PUBLIC_LEGACY_API_URL fix for project-detail 404s.

Not included

PRs #97 and #98 are still open. #98 matters for this deploy: it adds the
fail-fast startup gate, JWKS rotation/outage handling, and the 401-vs-503
split. Without it, a backend with incomplete Auth0 config starts happily and
fails every authenticated request instead of crash-looping visibly. The
biosim-gke ConfigMaps already carry AUTH0_DOMAIN + AUTH0_AUDIENCE, so the
configured path works — but AUTH0_MANAGEMENT_CLIENT_ID/SECRET are not set in
the cluster, so PATCH/DELETE /api/v1/me will fail there until they are.

Release procedure

1. Merge this PR.
2. Tag the merge commit on main and push both tags:
   backend-v0.10.0, frontend-v0.2.0 — each triggers release.yaml, which
   builds amd64 images to GHCR and cuts a GitHub Release.
3. Verify both images exist in GHCR before touching the overlay.
4. Separate PR bumps kustomize/overlays/biosim-gke/kustomization.yaml;
   merging that is the deploy, now that Flux reconciles that path.

Step 3 is not optional anymore: api uses the Recreate strategy with a single
replica, so pointing the overlay at an image that was never published takes the
API down rather than leaving old pods serving.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MfRrxjsddsBLcFeNCXSBcU