Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

api/cmd/api/main.go

@@ -19,6 +19,7 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/sentry/sentry/api/internal/authz"
 	"github.com/sentry/sentry/api/internal/config"
 	"github.com/sentry/sentry/api/internal/dashboards"
 	"github.com/sentry/sentry/api/internal/httpserver"
@@ -88,9 +89,19 @@ func main() {
 		os.Exit(1)
 	}
 
+	// authorizer is nil (RequireRole* becomes a no-op) unless
+	// ENTERPRISE_AUTH_URL is configured -- matches Phase 0-3 behavior
+	// for a single-tenant deployment with no enterprise/ deployed.
+	var authorizer authz.Authorizer
+	if cfg.EnterpriseAuthURL != "" {
+		authorizer = authz.NewHTTPAuthorizer(cfg.EnterpriseAuthURL)
+	}
+
 	sqlRunner := executor.NewChRunner(conn)
-	queryHandler := queryapi.NewHandler(logger, sqlRunner, search, cfg.QueryTimeout)
-	dashboardsHandler := dashboards.NewHandler(logger, dashboards.NewStore(pgPool))
+	// audit logging is nil (a no-op) until Phase 4 task 5 wires in
+	// enterprise/internal/audit -- see queryapi.AuditLogger's doc comment.
+	queryHandler := queryapi.NewHandler(logger, sqlRunner, search, cfg.QueryTimeout, nil, authorizer)
+	dashboardsHandler := dashboards.NewHandler(logger, dashboards.NewStore(pgPool), authorizer)
 
 	// One shared mux, CORS applied once around the whole thing -- see
 	// internal/httpserver's doc comment for why this changed from each