chore(examples): bring every example up to server 2.4.0-rc.18

[lakhansamani]

Summary

Rebase onto main (which had since landed the Go /v2 migration and the JS/React bumps) and take every example to the SDK releases that match server 2.4.0-rc.18. Verifying each example against a real rc.18 server turned up six things that were actually broken; those fixes are the bulk of the diff.

Versions

SDK	was	now
authorizer-go	v2.2.0-rc.4 (+ two examples still on a local replace)	v2.2.0-rc.5
authorizer-proto-go	vendored gen/ stubs in with-grpc	v0.2.0-rc.1 as a real dependency
authorizer-py	0.2.0 / 0.3.0rc3	0.3.0rc4
authorizer-js	^3.3.0	^4.0.0-rc.0
authorizer-react	^2.2.0-rc.6	^2.2.0-rc.7
authorizer-vue	1.0.0-beta.0	1.0.0-beta.2

Every lockfile regenerated; each resolves a single deduped authorizer-js. authorizer-svelte stays at 0.1.8 (latest published).

Fixes found by running each example against rc.18

• _delete_user takes an id, not an email. The three raw-GraphQL callers (with-agent-delegation, with-agent-permissions, with-fga-advanced) now resolve the id via _user first. Same change is why authorizer-js goes to a new major.
• The 2.4.0 MFA offer was never settled in four examples, so none of them could get a token against a default server. skip_mfa_setup is identified by the mfa_session cookie, which the server marks Secure (--app-cookie-secure defaults to true) — httpx/browsers keep it but will not replay it over plain http, and authorizer-go keeps no cookie jar at all. with-go, with-grpc, with-agents-python and with-rag-fga now relay it by hand, as with-python already did. (gRPC has no cookies: the server serialises them as set-cookie response metadata, which the example reads back and replays as cookie request metadata.)
• with-grpc's vendored stubs predated the proto change — DeleteUserRequest.GetEmail() no longer exists in rc.18. Replaced by a dependency on authorizer-proto-go, the same module the Go SDK uses; drops ~16k lines of generated code.
• with-agent-permissions section 8 asserted the pre-2.4.0 behaviour. A model with no type agent now denies a delegated check rather than granting the user's full authority; --fga-allow-unconstrained-agents is the migration opt-out. Demo and README corrected.
• TOTP codes are single-use (RFC 6238 §5.2) in rc.18. with-auth-recipes/2-totp-mfa replayed the enrollment code at the login challenge and failed with invalid otp; it now waits for the next time step.
• Every Docker stack died at boot. The image runs as uid 1000 and a named volume at /data is created root-owned, so unable to open database file. with-microservices, with-org-saml, with-org-sso-oidc and with-spiffe keep the SQLite file under /authorizer instead.
• with-microservices forwarded an X-User-Email that was always empty — access tokens carry no email claim (it is in the ID token and at /userinfo). Forwards the sub only, and says why.
• with-python drops both 0.2.0 escape hatches: typed skip_mfa_setup and AuthorizerAdminClient.users() both work on 0.3.0rc4.
• run-server.sh / mcp-agent.mjs take a SERVER_DIR override so the demos can be pointed at a specific server checkout.

Testing

Against a server built from tag 2.4.0-rc.18 (make dev config, RS256), end to end unless noted:

• Ran green: with-go, with-grpc, with-python, with-rag-fga (seed + all three personas, both strategies), with-agents-python (sync + async), with-m2m-client-credentials, with-token-exchange-delegation, with-fga-permissions, with-fga-advanced (setup + walkthrough + list-permissions), with-agent-delegation, with-agent-permissions (demo + mcp-agent --verify), with-mcp, with-a2a-agent-card, with-scim (all three scripts), with-microservices (docker, rc.18 image), with-microservices-go (5/5), with-openid-connect (full browser round trip + RP-initiated logout), with-auth-recipes 1/2/4.
• Builds/typechecks: with-react, with-nextjs, with-nextjs-13, with-vue, with-svelte-kit, with-svelte-routing, with-react-native-expo (tsc --noEmit); authorizer-js 4.0.0-rc.0 UMD exercised in a browser against rc.18 for with-vanilla-js; validateJWTToken exercised for with-express-js.
• Partially verified (external prerequisite, not a code gap): with-auth-recipes/3-webhooks — admin ops and signup pass, the delivery leg needs the documented sudo ifconfig lo0 alias loopback alias. with-claude-agents — setup, delegation, aud rejection and the FGA prod denial all pass; the happy path needs ANTHROPIC_API_KEY. with-agent-permissions/gemini-agent.mjs needs a Gemini key. with-spiffe, with-org-saml, with-org-sso-oidc hard-require a public https tunnel; their compose stacks boot clean on rc.18 and their admin mutations were checked field-by-field against the rc.18 schema. with-k8s-tokenreview needs a cluster (app builds and vets). with-gatsbyjs — lockfile resolution verified; gatsby build cannot run here because lmdb-store has no darwin/arm64 prebuild for Node 22.
• Every example's GraphQL operations and input-object fields were also diffed programmatically against the rc.18 schema; no other drift.

Follow-ups for other repos (not fixable here)

1. authorizer-go builds a fresh http.Client per call with no cookie jar, so the cookie-identified flows (skip_mfa_setup, verify_otp) cannot work through the SDK. Every Go example has to hand-roll the relay.
2. The server marks mfa_session Secure even when serving plain http, so a conforming client drops it. Any non-browser SDK on a local http dev server hits this.
3. authorizer-vue (1.0.0-beta.2) and authorizer-svelte (0.1.8) still depend on authorizer-js ^1.2.x — two majors behind the server they talk to, and predating the MFA-offer flow entirely. Both are already at their latest published version, so with-vue, with-svelte-kit and with-svelte-routing can only be verified as far as "builds" until those SDKs are released against authorizer-js 4.x. authorizer-vue main already carries the v3 migration but is unpublished.

Please squash-merge

with-grpc/with-grpc — a 17MB binary my go build dropped in the working tree — was committed by accident and removed two commits later, so the blob is reachable from this branch's history. Squashing keeps it out of main's object store; happy to rewrite the branch instead if you'd rather merge-commit.

Please review — not self-merging.