Close search's active-tenant write-routing gap with a polled allowlist

search/src/consumer.rs's write-routing (built last pass) had no active-
tenant check at all: IndexRegistry.resolve() would open-or-create an
index directory for any syntactically-valid tenant_id, active or not --
unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot
built at enterprise-ingest startup) or the read side (gated by
searchclient.TenantChecker, a direct rbacstore query). search is AGPL
core with no Postgres access and no enterprise/ import allowed, so it
needed a network boundary instead -- the same shape ingest's
TenantResolver already uses against enterprise-auth, just Rust calling
Go instead of Go calling Go.

New GET /internal/active-tenants endpoint on enterprise-auth
(rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants),
gated on a RoleService Bearer credential -- server-to-server auth, the
same shape alerting presents to api, minted via the already-generic
enterprise-auth -mint-service-token search. search/src/tenants.rs's
ActiveTenantTracker polls it every 60s, blocking startup on the first
fetch succeeding (fail-closed cold start -- a control-plane outage at
boot must not silently accept every tenant_id) and keeping the last-
known-good set on any later refresh failure (a transient blip shouldn't
stop every tenant's indexing, only prevent the allowlist from growing/
shrinking until connectivity resumes). consumer.rs refuses any tagged
record whose tenant isn't in the polled set, before ever calling
resolve() -- IndexRegistry itself stays policy-free, matching the same
mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry
already draws on the ClickHouse side.

Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both
set (search/src/config.rs rejects exactly one being set) -- every
existing deployment is unaffected.

Verified with real HTTP round trips in this environment: tenants.rs's
tests exercise real reqwest requests (actual Authorization: Bearer
header, actual JSON parsing) against a hand-rolled dependency-free TCP
test server, including both fail-closed paths (rejected first fetch,
unreachable server). authhandler's new tests cover the credential-kind
distinction this endpoint exists to enforce -- a real human session,
even for a genuine Owner, must not satisfy a check meant for a service
identity.

One asymmetry remains, disclosed rather than fixed: chwriter.Registry's
snapshot still never refreshes (stale until enterprise-ingest restarts),
while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter
staleness window. Neither is a live per-write check -- that would mean
a database/HTTP round trip per record, a throughput cost neither
implementation accepts -- so both have some staleness window by design;
the gap between the two windows is what's disclosed, not a claim either
is fully live.

CLAUDE.md

@@ -267,17 +267,24 @@ gate a commercially-licensed credential behind, so there was never an
 import-boundary reason to split it out), so read and write share one
 registry directly. The periodic Tantivy commit now commits every tenant
 index that's seen a write, not just the default one
-(`IndexRegistry::commit_all`). **One gap disclosed, not fixed, in this
-same change**: unlike `chwriter.Registry` (built from an
-active-tenants-only snapshot at startup) and unlike the read side (gated
-by `searchclient.TenantChecker`), this consumer's `resolve()` call has
-no active-tenant check — this process has no Postgres access to check
-against, so a still-valid-but-should-be-revoked ingest credential can
-cause an index directory to be created for a tenant that's no longer
-active. Narrow blast radius (an orphan, isolated, empty index — not
-cross-tenant leakage — and only reachable with a real signed
-credential), but real; see `search/src/registry.rs`'s doc comment on
-`resolve`. **The tenant-picker page is now built too**:
+(`IndexRegistry::commit_all`). **The active-tenant gap this same change
+originally disclosed is now closed too**: `search/src/tenants.rs`'s
+`ActiveTenantTracker` polls a new `GET /internal/active-tenants`
+endpoint on `enterprise-auth` (`search` has no Postgres access, unlike
+`chwriter.Registry`'s direct `rbacstore` query or the read side's
+`searchclient.TenantChecker`, so this needed a network call — the same
+"network boundary, not import boundary" shape `ingest`'s
+`TenantResolver` already uses against the same service, authenticated
+with a RoleService credential the same way `alerting` authenticates to
+`api`) and `consumer.rs` refuses any tagged record whose tenant isn't in
+the polled allowlist. Off unless both `ENTERPRISE_AUTH_URL` and
+`ENTERPRISE_AUTH_SERVICE_TOKEN` are set (same "off unless configured"
+default as everything else optional in this codebase); when they are,
+startup blocks on the first fetch succeeding and later refresh failures
+keep serving the last-known-good set rather than clearing it. Verified
+with real HTTP round trips against a hand-rolled TCP test server in this
+environment, no live enterprise-auth needed. **The tenant-picker page is
+now built too**:
 `web/src/routes/select-tenant` calls `GET /auth/memberships`/
 `POST /auth/select-tenant` via `fetch(..., {credentials: 'include'})`
 (new `$lib/api.ts` functions), which needed a second CORS posture