feat: integrate tenant SSO and remote toggle

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

deploy/helm/go-guess/templates/app-deployment.yaml

@@ -48,8 +48,6 @@ spec:
               value: {{ .Values.app.tokenTTL | quote }}
             - name: MAX_UPLOAD_MB
               value: {{ .Values.app.maxUploadMB | quote }}
-            - name: GO_LOOSE_BASE_URL
-              value: {{ .Values.app.goLooseBaseURL | quote }}
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:

deploy/helm/go-guess/values.yaml

@@ -15,8 +15,6 @@ app:
   frontendURL: http://localhost:8080
   tokenTTL: 8h
   maxUploadMB: 10
-  # Authorize URL for Go Loose. %s is the request X-Tenant-Id.
-  goLooseBaseURL: https://%s.auth.dev
 
 secrets:
   jwtSecret: ""

deploy/nginx/README.md

@@ -58,5 +58,5 @@ services should remain `ClusterIP` services without NodePorts.
 Protected interviewer routes also call Go Loose from the application pod, using
 `app.goLooseBaseURL` (default `https://%s.auth.dev`, where `%s` is the
 request tenant). That address must be reachable from the cluster. The browser
-sends `X-API-Key` only when the published frontend image was built with
-`VITE_GO_LOOSE_API_KEY`. Nginx does not add or strip that header.
+forwards browser authentication and API requests without adding application
+credentials. Nginx does not add or strip authorization headers.