Add Auth0 client_credentials auth to simulation gateway calls

[MaxGhenis]

Summary

The simulation gateway now requires a bearer JWT on every write and job-status endpoint (policyengine-api-v2 PR #458). Without this change, the next prod deploy of policyengine-api-v2 would break every society-wide report: v1 calls the gateway unauthenticated and would start getting 403s. This PR adds the client side so both can ship safely.

Changes

New module — policyengine_api/libs/gateway_auth.py

• GatewayAuthTokenProvider fetches a client_credentials access token from Auth0, caches it in-process, and refreshes 60 s before expiry. Thread-safe (threading.Lock) so worker processes can share a single instance.
• GatewayBearerAuth is a small httpx.Auth adapter that attaches Authorization: Bearer <token> to every request.
• GatewayAuthError for clear failure modes (misconfigured, Auth0 HTTP error, missing access_token).

Client wiring — policyengine_api/libs/simulation_api_modal.py

• SimulationAPIModal.__init__ now constructs a GatewayAuthTokenProvider and, when all four GATEWAY_AUTH_* env vars are present, passes a GatewayBearerAuth to httpx.Client(auth=...). Missing vars leave auth off (preserves local/dev behavior against a gateway running with GATEWAY_AUTH_DISABLED=1).

Deploy plumbing — .github/workflows/push.yml, gcp/export.py, gcp/policyengine_api/Dockerfile

• Follows the established pattern for other secrets: GH Action secret → env var on make deploy → export.py substitutes literal placeholders in the Dockerfile → App Engine runtime reads them as env vars. Four new vars: GATEWAY_AUTH_ISSUER, GATEWAY_AUTH_AUDIENCE, GATEWAY_AUTH_CLIENT_ID, GATEWAY_AUTH_CLIENT_SECRET.

Tests — tests/unit/libs/test_gateway_auth.py (new), tests/unit/libs/test_simulation_api_modal.py

• 12 new tests covering configured, first-call fetch, caching, expiry refresh, trailing-slash normalization, Auth0 HTTP errors, missing-access-token, invalidate(), and the bearer header attachment.
• 2 new tests on SimulationAPIModal.__init__ asserting the auth kwarg is wired correctly when env vars are present / absent.

Test plan

• make test green (includes existing and new unit tests)
• Deploy to staging/beta GAE (or verify against beta policyengine-api-v2 gateway locally with SIMULATION_API_URL pointed at beta)
• Trigger a society-wide report end-to-end: submit → poll → result
• Confirm no 403/401 on gateway calls; confirm token fetch happens once per process then reuses from cache

Order of operations

This PR is safe to merge before the policyengine-api-v2 gateway actually enforces auth against real prod traffic, because:

• If the four env vars are unset in the deploy env, SimulationAPIModal attaches no auth and behavior is unchanged.
• If they are set, the gateway currently ignores unauthenticated requests (gating is deployed but prod hasn't deployed since Update PolicyEngine US to 0.324.0 #458 merged and CI's been stuck).

After policyengine-api-v2's deploy pipeline unsticks (tracked in PolicyEngine/policyengine-api-v2#461), set the four GATEWAY_AUTH_* GH Action secrets on this repo and deploy.

🤖 Generated with Claude Code