Close search's active-tenant write-routing gap with a polled allowlist

search/src/consumer.rs's write-routing (built last pass) had no active-
tenant check at all: IndexRegistry.resolve() would open-or-create an
index directory for any syntactically-valid tenant_id, active or not --
unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot
built at enterprise-ingest startup) or the read side (gated by
searchclient.TenantChecker, a direct rbacstore query). search is AGPL
core with no Postgres access and no enterprise/ import allowed, so it
needed a network boundary instead -- the same shape ingest's
TenantResolver already uses against enterprise-auth, just Rust calling
Go instead of Go calling Go.

New GET /internal/active-tenants endpoint on enterprise-auth
(rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants),
gated on a RoleService Bearer credential -- server-to-server auth, the
same shape alerting presents to api, minted via the already-generic
enterprise-auth -mint-service-token search. search/src/tenants.rs's
ActiveTenantTracker polls it every 60s, blocking startup on the first
fetch succeeding (fail-closed cold start -- a control-plane outage at
boot must not silently accept every tenant_id) and keeping the last-
known-good set on any later refresh failure (a transient blip shouldn't
stop every tenant's indexing, only prevent the allowlist from growing/
shrinking until connectivity resumes). consumer.rs refuses any tagged
record whose tenant isn't in the polled set, before ever calling
resolve() -- IndexRegistry itself stays policy-free, matching the same
mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry
already draws on the ClickHouse side.

Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both
set (search/src/config.rs rejects exactly one being set) -- every
existing deployment is unaffected.

Verified with real HTTP round trips in this environment: tenants.rs's
tests exercise real reqwest requests (actual Authorization: Bearer
header, actual JSON parsing) against a hand-rolled dependency-free TCP
test server, including both fail-closed paths (rejected first fetch,
unreachable server). authhandler's new tests cover the credential-kind
distinction this endpoint exists to enforce -- a real human session,
even for a genuine Owner, must not satisfy a check meant for a service
identity.

One asymmetry remains, disclosed rather than fixed: chwriter.Registry's
snapshot still never refreshes (stale until enterprise-ingest restarts),
while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter
staleness window. Neither is a live per-write check -- that would mean
a database/HTTP round trip per record, a throughput cost neither
implementation accepts -- so both have some staleness window by design;
the gap between the two windows is what's disclosed, not a claim either
is fully live.

enterprise/internal/authhandler/authhandler.go

@@ -13,6 +13,9 @@
 // api/authz) and a different credential type (an ingest bearer token
 // checked against rbacstore's ingest_credentials table, not a
 // session.Manager JWT) -- see ingestCredentialValidator's doc comment.
+//
+// GET /internal/active-tenants is a third sibling, for `search`
+// (core/AGPL, Rust) -- see tenantLister's doc comment.
 package authhandler
 
 import (
@@ -50,21 +53,36 @@ type ingestCredentialValidator interface {
 	ValidateIngestCredential(ctx context.Context, token string) (tenantID string, err error)
 }
 
+// tenantLister is the narrow interface GET /internal/active-tenants
+// needs -- *rbacstore.Store is the production implementation (the same
+// concrete type ingestCredentials above already wires in, just a
+// second narrow interface it happens to also satisfy). Backs
+// search/src/tenants.rs's ActiveTenantTracker: search is AGPL core with
+// no Postgres access and no enterprise/ import allowed, so its write-
+// routing needed a network boundary to learn which tenants are active,
+// the same shape ingest/internal/grpcserver.TenantResolver already uses
+// against this exact service (see that package's doc comment).
+type tenantLister interface {
+	ListActiveTenantIDs(ctx context.Context) ([]string, error)
+}
+
 type Handler struct {
 	logger            *slog.Logger
 	manager           *session.Manager
 	features          Features
 	ingestCredentials ingestCredentialValidator
+	tenants           tenantLister
 }
 
-func New(logger *slog.Logger, manager *session.Manager, features Features, ingestCredentials ingestCredentialValidator) *Handler {
-	return &Handler{logger: logger, manager: manager, features: features, ingestCredentials: ingestCredentials}
+func New(logger *slog.Logger, manager *session.Manager, features Features, ingestCredentials ingestCredentialValidator, tenants tenantLister) *Handler {
+	return &Handler{logger: logger, manager: manager, features: features, ingestCredentials: ingestCredentials, tenants: tenants}
 }
 
 func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /internal/authorize", h.handleAuthorize)
 	mux.HandleFunc("GET /auth/features", h.handleFeatures)
 	mux.HandleFunc("POST /internal/authorize-ingest", h.handleAuthorizeIngest)
+	mux.HandleFunc("GET /internal/active-tenants", h.handleActiveTenants)
 }
 
 type featuresResponse struct {
@@ -146,6 +164,44 @@ func (h *Handler) handleAuthorizeIngest(w http.ResponseWriter, r *http.Request)
 	_ = json.NewEncoder(w).Encode(authorizeIngestResponse{TenantID: tenantID})
 }
 
+type activeTenantsResponse struct {
+	TenantIDs []string `json:"tenant_ids"`
+}
+
+// handleActiveTenants is search/src/tenants.rs's ActiveTenantTracker's
+// server side -- polled periodically, not per-write, to build a local
+// allowlist for its write-routing gate (see that module's doc comment).
+// Requires a RoleService Bearer credential (session.Manager-issued,
+// Role == "service"), not a human session -- server-to-server, the same
+// authentication shape /alerting presents to /api, minted via
+// `enterprise-auth -mint-service-token search` (the flag is already
+// generic over caller name; no change needed there for a new caller).
+// Deliberately does NOT accept the tenant-scoped credential a human
+// session or an ingest credential would carry: this endpoint answers
+// "which tenants exist," a question no single tenant's identity should
+// be able to ask on its own.
+func (h *Handler) handleActiveTenants(w http.ResponseWriter, r *http.Request) {
+	token := bearerToken(r.Header.Get("Authorization"))
+	if token == "" {
+		http.Error(w, "no credentials presented", http.StatusUnauthorized)
+		return
+	}
+	claims, err := h.manager.Validate(token)
+	if err != nil || claims.Role != "service" {
+		http.Error(w, "invalid or expired credentials", http.StatusUnauthorized)
+		return
+	}
+
+	ids, err := h.tenants.ListActiveTenantIDs(r.Context())
+	if err != nil {
+		h.logger.Error("listing active tenant ids", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(activeTenantsResponse{TenantIDs: ids})
+}
+
 func bearerToken(header string) string {
 	const prefix = "Bearer "
 	if !strings.HasPrefix(header, prefix) {