Close search's active-tenant write-routing gap with a polled allowlist

search/src/consumer.rs's write-routing (built last pass) had no active-
tenant check at all: IndexRegistry.resolve() would open-or-create an
index directory for any syntactically-valid tenant_id, active or not --
unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot
built at enterprise-ingest startup) or the read side (gated by
searchclient.TenantChecker, a direct rbacstore query). search is AGPL
core with no Postgres access and no enterprise/ import allowed, so it
needed a network boundary instead -- the same shape ingest's
TenantResolver already uses against enterprise-auth, just Rust calling
Go instead of Go calling Go.

New GET /internal/active-tenants endpoint on enterprise-auth
(rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants),
gated on a RoleService Bearer credential -- server-to-server auth, the
same shape alerting presents to api, minted via the already-generic
enterprise-auth -mint-service-token search. search/src/tenants.rs's
ActiveTenantTracker polls it every 60s, blocking startup on the first
fetch succeeding (fail-closed cold start -- a control-plane outage at
boot must not silently accept every tenant_id) and keeping the last-
known-good set on any later refresh failure (a transient blip shouldn't
stop every tenant's indexing, only prevent the allowlist from growing/
shrinking until connectivity resumes). consumer.rs refuses any tagged
record whose tenant isn't in the polled set, before ever calling
resolve() -- IndexRegistry itself stays policy-free, matching the same
mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry
already draws on the ClickHouse side.

Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both
set (search/src/config.rs rejects exactly one being set) -- every
existing deployment is unaffected.

Verified with real HTTP round trips in this environment: tenants.rs's
tests exercise real reqwest requests (actual Authorization: Bearer
header, actual JSON parsing) against a hand-rolled dependency-free TCP
test server, including both fail-closed paths (rejected first fetch,
unreachable server). authhandler's new tests cover the credential-kind
distinction this endpoint exists to enforce -- a real human session,
even for a genuine Owner, must not satisfy a check meant for a service
identity.

One asymmetry remains, disclosed rather than fixed: chwriter.Registry's
snapshot still never refreshes (stale until enterprise-ingest restarts),
while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter
staleness window. Neither is a live per-write check -- that would mean
a database/HTTP round trip per record, a throughput cost neither
implementation accepts -- so both have some staleness window by design;
the gap between the two windows is what's disclosed, not a claim either
is fully live.

enterprise/internal/rbacstore/rbacstore.go

@@ -198,6 +198,34 @@ func (s *Store) TenantIsActive(ctx context.Context, tenantID string) (bool, erro
 	return t.Status == "active", nil
 }
 
+// ListActiveTenantIDs backs enterprise-auth's GET /internal/active-tenants
+// -- search (AGPL core) polls this to learn which tenant_ids it may
+// safely write-route into their own Tantivy index, since it has no
+// Postgres access of its own (see search/src/tenants.rs's doc comment
+// for the full design). Deliberately narrower than
+// ListProvisionedDataSources (which also requires ClickHouse
+// credentials to be present, since chwriter.Registry needs those to
+// actually connect): search's write path needs nothing but the id.
+func (s *Store) ListActiveTenantIDs(ctx context.Context) ([]string, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id FROM tenants WHERE status = 'active'`)
+	if err != nil {
+		return nil, fmt.Errorf("rbacstore: listing active tenant ids: %w", err)
+	}
+	defer rows.Close()
+	var ids []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("rbacstore: scanning active tenant id: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("rbacstore: iterating active tenant ids: %w", err)
+	}
+	return ids, nil
+}
+
 // SetTenantStatus is the only way a tenant's status column changes --
 // every tenant-resolution path elsewhere must re-check this via
 // GetTenant, never cache/assume 'active', per

enterprise/internal/rbacstore/rbacstore_test.go

@@ -470,6 +470,41 @@ func createTestDashboard(t *testing.T, s *Store, tenantID, createdBy string) str
 	return id
 }
 
+func TestListActiveTenantIDsExcludesNonActive(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+
+	active := "test-tenant-" + uniqueSuffix()
+	provisioning := "test-tenant-" + uniqueSuffix()
+
+	for _, id := range []string{active, provisioning} {
+		if _, err := s.CreateTenant(ctx, id, id); err != nil {
+			t.Fatalf("CreateTenant %s: %v", id, err)
+		}
+	}
+	if err := s.SetTenantStatus(ctx, active, "active"); err != nil {
+		t.Fatalf("SetTenantStatus active: %v", err)
+	}
+	// provisioning stays in 'provisioning' (CreateTenant's default).
+
+	ids, err := s.ListActiveTenantIDs(ctx)
+	if err != nil {
+		t.Fatalf("ListActiveTenantIDs: %v", err)
+	}
+	foundActive := false
+	for _, id := range ids {
+		if id == provisioning {
+			t.Fatalf("non-active tenant %q leaked into ListActiveTenantIDs", provisioning)
+		}
+		if id == active {
+			foundActive = true
+		}
+	}
+	if !foundActive {
+		t.Fatal("expected the active tenant to be in the list")
+	}
+}
+
 func TestSetDashboardPermissionThenGet(t *testing.T) {
 	s := testStore(t)
 	ctx := context.Background()