Close search's active-tenant write-routing gap with a polled allowlist

search/src/consumer.rs's write-routing (built last pass) had no active-
tenant check at all: IndexRegistry.resolve() would open-or-create an
index directory for any syntactically-valid tenant_id, active or not --
unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot
built at enterprise-ingest startup) or the read side (gated by
searchclient.TenantChecker, a direct rbacstore query). search is AGPL
core with no Postgres access and no enterprise/ import allowed, so it
needed a network boundary instead -- the same shape ingest's
TenantResolver already uses against enterprise-auth, just Rust calling
Go instead of Go calling Go.

New GET /internal/active-tenants endpoint on enterprise-auth
(rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants),
gated on a RoleService Bearer credential -- server-to-server auth, the
same shape alerting presents to api, minted via the already-generic
enterprise-auth -mint-service-token search. search/src/tenants.rs's
ActiveTenantTracker polls it every 60s, blocking startup on the first
fetch succeeding (fail-closed cold start -- a control-plane outage at
boot must not silently accept every tenant_id) and keeping the last-
known-good set on any later refresh failure (a transient blip shouldn't
stop every tenant's indexing, only prevent the allowlist from growing/
shrinking until connectivity resumes). consumer.rs refuses any tagged
record whose tenant isn't in the polled set, before ever calling
resolve() -- IndexRegistry itself stays policy-free, matching the same
mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry
already draws on the ClickHouse side.

Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both
set (search/src/config.rs rejects exactly one being set) -- every
existing deployment is unaffected.

Verified with real HTTP round trips in this environment: tenants.rs's
tests exercise real reqwest requests (actual Authorization: Bearer
header, actual JSON parsing) against a hand-rolled dependency-free TCP
test server, including both fail-closed paths (rejected first fetch,
unreachable server). authhandler's new tests cover the credential-kind
distinction this endpoint exists to enforce -- a real human session,
even for a genuine Owner, must not satisfy a check meant for a service
identity.

One asymmetry remains, disclosed rather than fixed: chwriter.Registry's
snapshot still never refreshes (stale until enterprise-ingest restarts),
while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter
staleness window. Neither is a live per-write check -- that would mean
a database/HTTP round trip per record, a throughput cost neither
implementation accepts -- so both have some staleness window by design;
the gap between the two windows is what's disclosed, not a claim either
is fully live.

search/src/registry.rs

@@ -22,29 +22,27 @@ use crate::index::SearchIndex;
 /// path every Phase 0-3 deployment, and every untagged record, still
 /// uses.
 ///
-/// **Known residual gap, disclosed rather than silently accepted**:
-/// unlike the read side (gated by `enterprise/internal/searchclient`'s
-/// `TenantChecker`, which refuses to even issue a search for a tenant
-/// that isn't `active` in `rbacstore`) and unlike ClickHouse's write
-/// side (`enterprise/internal/chwriter.Registry`, built once at startup
-/// from `rbacstore.ListProvisionedDataSources` -- `active` tenants
-/// only, so an unrecognized `tenant_id` has no writer and the whole
-/// batch is refused), this registry's `resolve` has no equivalent gate
-/// on the write path: `consumer.rs` calls it directly, with no Postgres
-/// access to check tenant status against, the same reason this
-/// module's doc comment used to give for the old read-side gap
-/// `TenantChecker` was built to close. A syntactically-valid `tenant_id`
-/// on an ingest credential that's still valid but should have been
-/// revoked (deprovisioning does not yet revoke `ingest_credentials`
-/// rows -- see `/CLAUDE.md`'s Phase 4 non-goals) can therefore cause an
-/// index directory to be silently created here for a tenant that isn't
-/// really active. The blast radius is narrow -- an orphan, isolated,
-/// empty-except-for-that-tenant's-own-traffic index directory, not
-/// cross-tenant data exposure, and only reachable with a real signed
-/// ingest credential, not by an arbitrary caller -- but it is real, not
-/// hypothetical. Closing it fully would mean giving `search` (AGPL
-/// core, no `enterprise/` import allowed) some way to learn which
-/// tenants are actually active; not designed yet.
+/// `resolve` itself still has no active-tenant gate of its own -- it
+/// will happily open-or-create an index for any syntactically-valid
+/// `tenant_id`, active or not. That's deliberate: this struct's job is
+/// managing index lifecycles, not policy, the same separation
+/// `clickhousewriter.Writer` (mechanism) vs. `chwriter.Registry`
+/// (policy: which tenants get a writer at all) draws on the ClickHouse
+/// side. The gate lives one layer up, at each caller:
+/// `enterprise/internal/searchclient.TenantChecker` for the read side
+/// (refuses to even issue a search for a tenant that isn't `active` in
+/// `rbacstore`, via a direct Postgres-backed query since that code runs
+/// in `enterprise/`), and `consumer.rs`'s `tenants::ActiveTenantTracker`
+/// for the write side (a polled allowlist fetched from a new
+/// `enterprise-auth` endpoint over HTTP -- `search` is AGPL core with no
+/// Postgres access and no `enterprise/` import allowed, so it needed a
+/// network boundary instead of an import one, the same shape
+/// `ingest/internal/grpcserver.TenantResolver` already uses against the
+/// same service). Both gates are optional at this layer -- `resolve`
+/// itself works identically whether or not either caller happens to
+/// gate it -- so a future caller that forgets to gate would silently
+/// reopen this exact class of gap; see `consumer.rs`'s call site for
+/// the write side's enforcement.
 pub struct IndexRegistry {
     default_index: Arc<SearchIndex>,
     tenants_root: PathBuf,