Give ingest a real tenant identity (write-routing deferred, disclosed)

Ingest tenant-awareness was named "undesigned, not just unbuilt" across
CLAUDE.md/threat-model.md/the runbook since early Phase 4 -- the last
major standing gap. Scoping was agreed via AskUserQuestion: a
config-supplied tenant_id + shared-secret token ingest validates
(smaller real implementation, no new PKI), over per-tenant mTLS
certs. This change builds that identity mechanism end to end and
attaches it to every record at the point it enters the system; it
deliberately does NOT build per-tenant write-routing for ClickHouse or
Tantivy -- that's real, separately-scoped follow-up work, disclosed
explicitly everywhere this was previously called undesigned, not
silently left half-done.

New pieces:

- metadata/migrations/0034 + enterprise/internal/rbacstore/
  ingest_credentials.go: a per-tenant bearer credential, only its
  SHA-256 hash ever persisted (same reasoning a password gets hashed,
  not stored raw) -- CreateIngestCredential returns the plaintext
  exactly once, ValidateIngestCredential/RevokeIngestCredential/
  ListIngestCredentialsForTenant round it out.
- enterprise-auth gains -create-ingest-credential-tenant/
  -list-ingest-credentials-tenant/-revoke-ingest-credential (same
  offline-operator-flag shape as every other credential-minting flag in
  this binary) and a new POST /internal/authorize-ingest endpoint
  (internal/authhandler) validating a presented token and resolving its
  tenant -- a genuinely different credential type from session-backed
  /internal/authorize, so it doesn't touch session.Manager at all.
- ingest (AGPL core) gains an optional TenantResolver
  (internal/grpcserver, nil by default) and its HTTP client
  implementation (internal/tenantresolver.HTTPResolver) -- a plain HTTP
  call to enterprise-auth's new endpoint, never an enterprise/ import,
  same "network boundary, not import boundary" shape
  api/authz.HTTPAuthorizer already uses for the query path.
  PushBatch now requires an `authorization: Bearer <token>` gRPC
  metadata entry once a resolver is configured, fails the whole batch
  closed on a missing/invalid credential (never falls back to "no
  tenant"), and attaches the resolved tenant ID to every record as a
  `tenant_id` Kafka message header before producing it.

Verified with real round trips at every layer, no Docker needed:
rbacstore's credential CRUD (skip-gated on live Postgres, same as every
other rbacstore integration test this phase), authhandler's new
endpoint (real HTTP via httptest, including the regression test that a
session token must not validate as an ingest credential), tenantresolver
(real HTTP client against httptest, same pattern as
authz.HTTPAuthorizer's own tests), and grpcserver's PushBatch (fake
resolver/producer -- no resolver leaves messages unchanged, a configured
resolver attaches the right header or fails closed on a bad/missing
token).

Helm: ingest.requireTenantCredential (default false) is a deliberate,
separate opt-in from enterprise.enabled -- turning ENTERPRISE_AUTH_URL
on for ingest requires every agent to already hold a credential or be
refused outright, so it must not default on just because
enterprise.enabled does (same reasoning api.yaml's ENTERPRISE_AUTH_URL
isn't tied to enterprise.enabled directly either). docker-compose.yml
leaves it unset, same as ever.

Docs updated everywhere this was called "undesigned": CLAUDE.md,
docs/architecture.md, docs/security/threat-model.md (including its
summary table, now split into "identity: built" vs "write-routing: not
yet"), docs/phase-4-runbook.md (new §13), enterprise/README.md.

enterprise/internal/rbacstore/rbacstore_test.go

@@ -771,3 +771,122 @@ func TestListMembershipsForTenant(t *testing.T) {
 		t.Fatalf("unexpected editor entry: %+v", got)
 	}
 }
+
+func TestCreateAndValidateIngestCredential(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+
+	token, err := s.CreateIngestCredential(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("CreateIngestCredential: %v", err)
+	}
+	if token == "" {
+		t.Fatal("expected a non-empty token")
+	}
+
+	got, err := s.ValidateIngestCredential(ctx, token)
+	if err != nil {
+		t.Fatalf("ValidateIngestCredential: %v", err)
+	}
+	if got != tenantID {
+		t.Fatalf("ValidateIngestCredential tenant = %q, want %q", got, tenantID)
+	}
+}
+
+func TestValidateIngestCredentialRejectsUnknownToken(t *testing.T) {
+	s := testStore(t)
+	if _, err := s.ValidateIngestCredential(context.Background(), "not-a-real-token"); err != ErrNotFound {
+		t.Fatalf("ValidateIngestCredential error = %v, want ErrNotFound", err)
+	}
+}
+
+// TestIngestCredentialTokenNeverStoredAsPlaintext is the regression test
+// for this table's whole reason for hashing: the raw token string must
+// not appear anywhere in the persisted row (only its hash), so a
+// database leak doesn't hand out usable credentials.
+func TestIngestCredentialTokenNeverStoredAsPlaintext(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+	token, err := s.CreateIngestCredential(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("CreateIngestCredential: %v", err)
+	}
+
+	var stored string
+	row := s.pool.QueryRow(ctx, `SELECT token_hash FROM ingest_credentials WHERE tenant_id = $1`, tenantID)
+	if err := row.Scan(&stored); err != nil {
+		t.Fatalf("reading stored token_hash: %v", err)
+	}
+	if stored == token {
+		t.Fatal("the plaintext token must never be stored directly in token_hash")
+	}
+	if stored != hashIngestToken(token) {
+		t.Fatalf("stored hash = %q, want sha256(token) = %q", stored, hashIngestToken(token))
+	}
+}
+
+func TestRevokeIngestCredential(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+	token, err := s.CreateIngestCredential(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("CreateIngestCredential: %v", err)
+	}
+	creds, err := s.ListIngestCredentialsForTenant(ctx, tenantID)
+	if err != nil || len(creds) != 1 {
+		t.Fatalf("ListIngestCredentialsForTenant = (%+v, %v), want exactly one", creds, err)
+	}
+
+	if err := s.RevokeIngestCredential(ctx, creds[0].ID); err != nil {
+		t.Fatalf("RevokeIngestCredential: %v", err)
+	}
+	if _, err := s.ValidateIngestCredential(ctx, token); err != ErrNotFound {
+		t.Fatalf("ValidateIngestCredential after revoke = %v, want ErrNotFound", err)
+	}
+}
+
+func TestRevokeIngestCredentialNotFound(t *testing.T) {
+	s := testStore(t)
+	if err := s.RevokeIngestCredential(context.Background(), uuid.NewString()); err != ErrNotFound {
+		t.Fatalf("RevokeIngestCredential error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestListIngestCredentialsForTenantExcludesOtherTenants(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+	otherTenantID := "test-tenant-" + uniqueSuffix()
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+	if _, err := s.CreateTenant(ctx, otherTenantID, "Other Tenant"); err != nil {
+		t.Fatalf("CreateTenant other: %v", err)
+	}
+	if _, err := s.CreateIngestCredential(ctx, tenantID); err != nil {
+		t.Fatalf("CreateIngestCredential: %v", err)
+	}
+	if _, err := s.CreateIngestCredential(ctx, otherTenantID); err != nil {
+		t.Fatalf("CreateIngestCredential other: %v", err)
+	}
+
+	creds, err := s.ListIngestCredentialsForTenant(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("ListIngestCredentialsForTenant: %v", err)
+	}
+	if len(creds) != 1 || creds[0].TenantID != tenantID {
+		t.Fatalf("unexpected credentials: %+v", creds)
+	}
+}