chore: tag internal callers with X-Client-Type: service

[vreshch]

Internal synthetic callers that hit PUBLIC agentage endpoints now send X-Client-Type: service, so the Vector edge classifier tags them user_type=service instead of user/bot.

Changed

• .github/workflows/deploy.yml "Wait + live smoke" - one svc_hdr=(...) array for the step, applied to the three public curls: https://${SITE_FQDN}/health (commit assert), / (hero grep), /robots.txt.
• packages/landing/src/lib/auth.ts - exported module-level SERVICE_CLIENT_HEADERS, applied centrally to the two AS hops that cross the public edge: GET auth.<domain>/api/auth/token and the remote JWKS fetch.
• packages/landing/src/app/api/session/sign-out/route.ts - server-side POST auth.<domain>/api/auth/sign-out now sends the same shared constant (imported, not redeclared).

n/a

• http://localhost:3100/ container smokes in deploy.yml (in-container, never crosses the edge).
• Client-component fetches (newsletter-form, unsubscribe-form, account-menu, doc-markdown-actions) - real browser traffic, must stay user.
• No cron/scheduled jobs, revalidation hooks, or sitemap/indexnow pings in this repo.

Verified

YAML parse of deploy.yml, npm run type-check (landing + shared), eslint + prettier on touched files, vitest packages/landing/src/lib/auth (5 passed). No e2e.

[github-actions]

✅ CI - Verify PASSED

Commit: af644fac3f0fffd665aba1d95418b0af09d1bfd2 · Branch: chore/service-client-type-header

• ✅ Type check
• ✅ Lint
• ✅ Format check
• ✅ Unit tests
• ✅ Build
• ✅ Landing e2e

🔗 View workflow run