Signup fixes, Lakehouse sidebar link, and CI login fix

[dauglyon]

Summary

Three small fixes around signup, the Lakehouse sidebar link, and a CI fix.

• Signup username validation: Mirror the kbase/auth2 NewUserName rules on the signup form: must start with a lowercase letter, only [a-z0-9_], no repeating or trailing underscores, ≤100 chars. The availability check previously compared availablename to username.toLowerCase(), so inputs like John passed the frontend check and were then rejected by the backend. Special-character inputs (John.Doe, bad-user, …) reported "Username is not available — Suggested: X" which was actually a format problem, not a collision. Now the form shows a specific format error and submit stays blocked until the input matches the backend rules.
• Skip user<N> pre-fill on ORCID signup: ORCID's provider-supplied username is the numeric ORCID iD (e.g. 0000-0002-1825-0097). auth2's NewUserName.sanitizeName strips all of that to empty and getAvailableUserName falls back to the literal user<N> (see Authentication.java:1185-1196 and DEFAULT_SUGGESTED_USER_NAME). The signup form was pre-populating the username field with user1/user2/etc. for every ORCID signup. Leave the field blank when the provider is OrcID so the user picks their own. Display name and email pre-fill from ORCID are unchanged.
• Lakehouse sidebar link role gate: The nav item was gated on CDM_JUPYTERHUB_ADMIN (admin only). The hub gates login on its APPROVED_ROLES list, which every BERDL repo and the spark_notebook user guide set to BERDL_USER; CDM_JUPYTERHUB_ADMIN remains the separate approver role. Switch the gate so users with BERDL_USER see the link. The KIND*AI routing roles (KBASE_STAFF, BERDL_KIND_USER) only pick the post-login landing page and are not used here.
• Rename CDM → Lakehouse: The link goes to hub.berdl.kbase.us. Rename the nav label, route (/lakehouse/redirect), component (LakehouseRedirect), deploy config key (lakehouse_domain), and build env var (REACT_APP_KBASE_LAKEHOUSE_DOMAIN). The CI hub's login page (kbase/cdm-jupyterhub templates/login.html) still links to /cdm/redirect, so that path redirects to the new route.
• CI: log in to GHCR with the workflow token: kbase/.github#70 (2026-04-10) removed the kbase-bot GHCR_TOKEN from the org and moved the shared build-push workflow to github.token. This repo's local copy of that workflow still used the secret, so every PR build since then failed at "Login to GHCR" before lint, tests, or the image build ran. Switch to github.actor/github.token with packages: write, matching the org workflow.

Test plan

Signup username validation

• Signup with a username containing an uppercase letter (e.g. John) — submit stays blocked, format error shown.
• Signup with bad-user, bad__user, baduser_, 1baduser — submit stays blocked with format error.
• Signup with a valid lowercased username (e.g. testuser) — submit proceeds to step 3.
• Username > 100 chars shows the "must be at most 100 characters" error.

ORCID signup pre-fill

• Start signup via ORCID — username field is empty (not user1).
• Start signup via Google/Globus/another provider — username field is still pre-filled from availablename.
• Display name and email are still pre-filled from the ORCID identity.

Lakehouse sidebar link

• Log in as a user with BERDL_USER but no admin role — Lakehouse link visible in sidebar.
• Log in as a user without BERDL_USER — Lakehouse link not visible.
• Clicking the link lands on /lakehouse/redirect and then the hub.
• Visiting /cdm/redirect lands on /lakehouse/redirect.

CI

• "Build and Push Images" passes end to end on this branch (login, lint, tests, multi-environment build, image push).

Unit tests

• npm run lint:strict, CI=true npm test . (302 tests), npm run build — all exit 0 under Node 20.11.1.

[briehl]

Looks good!