Fix enterprise-auth's Docker build context and ClickHouse admin access

enterprise/Dockerfile built from enterprise/ alone, too narrow for
enterprise/go.mod's replace ../api directive once enterprise-auth
started importing api/httpserver and (transitively) api/dashboards --
confirmed broken the first time this was built with real Docker access.
Fixed to build from the repo root, matching enterprise-api/
enterprise-ingest's Dockerfiles.

Also: ClickHouse's default admin user genuinely lacked CREATE USER
privilege in docker-compose.yml -- the official image needs
CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 (not the more obvious-looking
CLICKHOUSE_ACCESS_MANAGEMENT, confirmed by reading the image's own
/entrypoint.sh), which this file never set. Every tenant-provisioning
code path was correct Go that had simply never been able to
authenticate its own admin connection strongly enough to run.

docker-compose.yml

@@ -72,6 +72,21 @@ services:
       # the actual security boundary here) — it exists purely to satisfy
       # this image's login gate for local/homelab use.
       CLICKHOUSE_PASSWORD: "sentry-dev-only"
+      # Phase 4's per-tenant provisioning (enterprise/internal/tenantprovision)
+      # runs CREATE USER/GRANT against this connection as the ClickHouse
+      # admin -- the official image's default user doesn't have
+      # access_management rights unless this is set, confirmed the hard
+      # way: -provision-tenant failed with "Not enough privileges... grant
+      # CREATE USER ON *.*" the first time this ran against a real
+      # ClickHouse container, since every prior verification of
+      # tenantprovision had been Docker-free (fakes) or never actually
+      # exercised the admin connection this env var gates. The variable is
+      # genuinely named CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT, not
+      # CLICKHOUSE_ACCESS_MANAGEMENT -- confirmed by reading the image's
+      # own /entrypoint.sh after the more obvious name silently did
+      # nothing (no error, just left access_management="0" in the
+      # generated users.d/default-user.xml).
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
     volumes:
       - clickhouse-data:/var/lib/clickhouse
     ulimits:
@@ -296,8 +311,8 @@ services:
   # manual testing (mint a service token, set the two env vars, restart).
   enterprise-auth:
     build:
-      context: enterprise
+      context: . # needs api/, ingest/, proto/, and enterprise/ itself -- see enterprise/Dockerfile's doc comment
-      dockerfile: Dockerfile
+      dockerfile: enterprise/Dockerfile
     container_name: sentry-enterprise-auth
     depends_on:
       metadata-migrate:

enterprise/Dockerfile

@@ -1,10 +1,23 @@
-# Commercial-license module, built the same way as every other Go
+# Commercial-license module, built like every other Go service here --
-# service here -- no /proto dependency, context is enterprise/ itself,
+# context must be the repo root, not enterprise/ alone. enterprise/go.mod
-# same shape as cli/Dockerfile and alerting/Dockerfile.
+# has replace directives for api/, ingest/, and proto/ (all resolved as
-#   docker build -f enterprise/Dockerfile -t sentry-enterprise-auth enterprise/
+# sibling directories, e.g. ../api), and enterprise-auth needs api/
+# specifically for two real reasons: cmd/enterprise-auth/main.go imports
+# api/httpserver directly (WithCredentialedCORS, for the tenant-picker's
+# credentialed cross-origin requests), and internal/rbacstore's
+# DashboardPermissions adapter imports api/dashboards transitively.
+# Go's module resolution needs the whole module's go.mod satisfied to
+# build any one package in it, so this was never actually optional the
+# way the old enterprise/-only context assumed -- confirmed broken the
+# first time this was built with real Docker access after those two
+# imports existed; the repo-root context below is the same shape
+# enterprise-api's and enterprise-ingest's Dockerfiles already use for
+# the identical reason.
+#   docker build -f enterprise/Dockerfile -t sentry-enterprise-auth .
 FROM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY . .
+WORKDIR /src/enterprise
 RUN CGO_ENABLED=0 GOOS=linux go build -o /out/enterprise-auth ./cmd/enterprise-auth
 
 FROM gcr.io/distroless/static-debian12