Rename the Keto User namespace to Identity, matching Kratos

src/keto.test.ts

@@ -1,6 +1,6 @@
 // Guards the Ory Keto config: migrations run before the server (keto-migrate →
 // keto), the DSN targets the keto database, read/write APIs serve on the ports config.ts
-// points at, and the OPL declares the role/group/resource namespaces. Version pinning is
+// points at, and the OPL declares the identity/role/group/resource namespaces. Version pinning is
 // in compose.test.ts. Real boot is verified by running the stack; this catches edits.
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -35,8 +35,8 @@ test("keto loads the OPL namespaces from the mounted file", () => {
     "namespaces come from the committed OPL");
 });
 
-test("the OPL declares role, group and a resource namespace over user subjects", () => {
-  for (const ns of ["User", "Group", "Role", "Resource"])
+test("the OPL declares role, group and a resource namespace over identity subjects", () => {
+  for (const ns of ["Identity", "Group", "Role", "Resource"])
     assert.match(opl, new RegExp(`class ${ns} implements Namespace`), `defines ${ns}`);
   // role + group are subject sets read at login → JWT roles claim (README).
   assert.match(opl, /class Role implements Namespace\s*{\s*related:\s*{\s*members:/,