Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

api/querylang/executor/chrunner.go

@@ -0,0 +1,58 @@
+package executor
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/ClickHouse/clickhouse-go/v2/lib/driver"
+)
+
+// ChRunner runs arbitrary (pre-validated) SELECT statements against
+// ClickHouse and shapes the result into JSON-friendly columns/rows,
+// discovering the result's column set at query time via reflection since
+// the query itself is arbitrary. Ported from Phase 0/1's
+// api/queryapi.Executor, which this replaces (see task 4) --
+// same logic, moved here since it's the query-execution layer's
+// plumbing, not specific to the old placeholder /query handler.
+type ChRunner struct {
+	conn driver.Conn
+}
+
+func NewChRunner(conn driver.Conn) *ChRunner {
+	return &ChRunner{conn: conn}
+}
+
+func (r *ChRunner) RunSQL(ctx context.Context, sql string) (*Result, error) {
+	rows, err := r.conn.Query(ctx, sql)
+	if err != nil {
+		return nil, fmt.Errorf("executing query: %w", err)
+	}
+	defer rows.Close()
+
+	columnTypes := rows.ColumnTypes()
+	result := &Result{
+		Columns: rows.Columns(),
+		Rows:    [][]any{},
+	}
+
+	for rows.Next() {
+		dest := make([]any, len(columnTypes))
+		for i, ct := range columnTypes {
+			dest[i] = reflect.New(ct.ScanType()).Interface()
+		}
+		if err := rows.Scan(dest...); err != nil {
+			return nil, fmt.Errorf("scanning row: %w", err)
+		}
+		row := make([]any, len(dest))
+		for i, d := range dest {
+			row[i] = reflect.ValueOf(d).Elem().Interface()
+		}
+		result.Rows = append(result.Rows, row)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterating rows: %w", err)
+	}
+
+	return result, nil
+}