feat(auth): migrate to Keycloak metadata auth

cli/tjwater_cli/core.py

@@ -46,7 +46,6 @@ class AuthContext:
     server: str | None = None
     access_token: str | None = None
     project_id: str | None = None
-    user_id: str | None = None
     username: str | None = None
     network: str | None = None
     headers: dict[str, str] = field(default_factory=dict)
@@ -98,7 +97,6 @@ def load_auth_context(auth_stdin: bool = False) -> AuthContext:
             "server": os.getenv("TJWATER_SERVER"),
             "access_token": os.getenv("TJWATER_ACCESS_TOKEN"),
             "project_id": os.getenv("TJWATER_PROJECT_ID"),
-            "user_id": os.getenv("TJWATER_USER_ID"),
             "username": os.getenv("TJWATER_USERNAME"),
             "network": os.getenv("TJWATER_NETWORK"),
             "headers": json.loads(extra_headers) if extra_headers else {},
@@ -117,7 +115,6 @@ def load_auth_context(auth_stdin: bool = False) -> AuthContext:
         server=_pick(raw, "server", "base_url"),
         access_token=_pick(raw, "access_token", "token", "accessToken"),
         project_id=_pick(raw, "project_id", "projectId", "x_project_id"),
-        user_id=_pick(raw, "user_id", "userId", "x_user_id"),
         username=_pick(raw, "username", "preferred_username"),
         network=_pick(raw, "network", "project_code", "projectCode", "project"),
         headers={str(key): str(value) for key, value in headers.items()},
@@ -350,8 +347,6 @@ def build_headers(
         headers["X-Project-Id"] = require_project_id(ctx)
     elif ctx.auth.project_id:
         headers["X-Project-Id"] = ctx.auth.project_id
-    if ctx.auth.user_id:
-        headers["X-User-Id"] = ctx.auth.user_id
     return headers