Hi, there! Understood, thank you for the clarification. I guess, I've somehow missed mention of that bonus section. Two more suggestions for more comprehensiveness: consider updating this course with a content addressing 1) using alternative approaches to authentication (open source projects, like Keycloak & Gluu, and commercial services, like Auth0 & Okta) and 2) multi-tenancy options and aspects. Hope this helps.
I'm very much against using services like auth0 to manage your auth. Not because I personally don't like auth0, it's just I dislike the idea of offloading such a critical aspect of your site to a third party service.
Multi-tenancy is tricky because it's super dependent on the app in question. There is no general solution. Using postgres schemas is ok sometimes but sometimes not. The implementation details between using multiple servers, multiple databases and multiple schemas is quite different too.
Re: commercial AuthN/AuthZ services - I definitely understand your rationale (though I've seen some passionate opinions of the opposite nature; not only Auth-related, but generally, in the vein of "outsource as much as possible of your infra to external services" (BTW, I strongly disagree with this stance for most cases). Returning to Auth, I guess, the right answer is "it depends".
Re: multi-tenancy - Yes, there are certainly various approaches, but most, if not all, represent those three that you mentioned. I thought that it would be nice to have your course expanded with demonstration of how relevant multi-tenancy design decisions (ideally, with all three options) affect other parts of the codebase and integrate with them. Perhaps, I want a perfect course, but since the focus here is on SaaS, multi-tenancy coverage IMO makes perfect sense.
There is already a separate 3+ hour bonus section where we build a RESTful API driven app (a 2nd app from the main course).
It doesn't use Vue -- instead it uses jquery + jsrender but you could totally replace the front-end to use Vue without needing to modify the back-end.
That app covers all sorts of things like API design, token based auth, websockets, etc..