refactor!: remove the inert PROJECT_NAME and the auth_diagnostics module

[JosteinGj]

⚠️ Breaking. Last of the stack, so it blocks nothing. Needs a datahub-sdk-docs note before release — see below.

Two things the SDK carried that no longer do anything.

auth_diagnostics

It existed to explain a 401 the api would not: it decoded the organization claim of the token just sent and reconstructed which of the validator's five branches had rejected it, because the authentication entry point answered with an empty body.

That is no longer true. Verified live against this backend:

$ curl -i http://localhost:8081/timeseries?limit=1
HTTP/1.1 401
{"detail":"Authentication is required. Send a bearer token in the Authorization header.",
 "status":401,"title":"Unauthorized",
 "type":"https://intellistream.ai/errors/unauthorized",
 "requestId":"…","retry":"change-request"}

SecurityConfig.refuseUnauthenticated writes Problems.unauthorized(authenticationFailureDetail(failure)), and OrganizationValidator supplies a written reason for every branch — including the ambiguous case this module's headline feature handled. The SDK was appending a near-duplicate of what the server had already said.

The base64 dependency existed only for this and goes with it.

The multi-tenant test that asserted on the reconstructed message now asserts on the server's own wording, so it still pins that the explanation survives the whole path from entry point to ResponseError.

One caveat kept in AGENTS.md: every entry-point 401 shares the unauthorized slug, so the cause lives in detail prose and cannot be branched on by type. Don't replace this with a slug match — there isn't one.

PROJECT_NAME

Accepted, stored, never read — cargo flagged the field as dead. The backend has no such concept on either side of the wire, while AGENTS.md and README.md both listed it as a supported variable. A config value that reads as real and affects nothing is worse than an absent one.

BREAKING CHANGE

DataHubConfig::from_vars loses its project_name parameter, as do the DataHubClient and AsyncDataHubClient constructors in the Python bindings.

• callers passing it positionally must drop the argument
• callers passing project_name= by keyword must remove it

python_tests/test_auth_constructor.py covers both constructors and passes.

Docs event for datahub-sdk-docs: the env-var list and the client constructor signatures both mention PROJECT_NAME.

---

Stack, 4 of 4 — based on #147.

Test count drops 262 → 248 here: the 14 auth_failure_tests go with the module they test.

🤖 Generated with Claude Code