Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

api/internal/querylang/lexer/lexer.go

@@ -12,23 +12,23 @@ type Kind int
 const (
 	EOF Kind = iota
 	Illegal
-	Ident   // bare words: field names, keywords, unquoted values/free-text terms
-	String  // quoted string: "..."
-	Number  // 123, 1.5
-	Pipe    // |
-	Eq      // =
-	Neq     // !=
-	Gt      // >
-	Gte     // >=
-	Lt      // <
-	Lte     // <=
-	Colon   // :
-	Comma   // ,
-	LParen  // (
-	RParen  // )
-	Minus   // -
-	Plus    // +
-	Star    // * (only meaningful inside count(*), same as SQL)
+	Ident  // bare words: field names, keywords, unquoted values/free-text terms
+	String // quoted string: "..."
+	Number // 123, 1.5
+	Pipe   // |
+	Eq     // =
+	Neq    // !=
+	Gt     // >
+	Gte    // >=
+	Lt     // <
+	Lte    // <=
+	Colon  // :
+	Comma  // ,
+	LParen // (
+	RParen // )
+	Minus  // -
+	Plus   // +
+	Star   // * (only meaningful inside count(*), same as SQL)
 )
 
 type Token struct {