Give ingest a real tenant identity (write-routing deferred, disclosed)

Ingest tenant-awareness was named "undesigned, not just unbuilt" across
CLAUDE.md/threat-model.md/the runbook since early Phase 4 -- the last
major standing gap. Scoping was agreed via AskUserQuestion: a
config-supplied tenant_id + shared-secret token ingest validates
(smaller real implementation, no new PKI), over per-tenant mTLS
certs. This change builds that identity mechanism end to end and
attaches it to every record at the point it enters the system; it
deliberately does NOT build per-tenant write-routing for ClickHouse or
Tantivy -- that's real, separately-scoped follow-up work, disclosed
explicitly everywhere this was previously called undesigned, not
silently left half-done.

New pieces:

- metadata/migrations/0034 + enterprise/internal/rbacstore/
  ingest_credentials.go: a per-tenant bearer credential, only its
  SHA-256 hash ever persisted (same reasoning a password gets hashed,
  not stored raw) -- CreateIngestCredential returns the plaintext
  exactly once, ValidateIngestCredential/RevokeIngestCredential/
  ListIngestCredentialsForTenant round it out.
- enterprise-auth gains -create-ingest-credential-tenant/
  -list-ingest-credentials-tenant/-revoke-ingest-credential (same
  offline-operator-flag shape as every other credential-minting flag in
  this binary) and a new POST /internal/authorize-ingest endpoint
  (internal/authhandler) validating a presented token and resolving its
  tenant -- a genuinely different credential type from session-backed
  /internal/authorize, so it doesn't touch session.Manager at all.
- ingest (AGPL core) gains an optional TenantResolver
  (internal/grpcserver, nil by default) and its HTTP client
  implementation (internal/tenantresolver.HTTPResolver) -- a plain HTTP
  call to enterprise-auth's new endpoint, never an enterprise/ import,
  same "network boundary, not import boundary" shape
  api/authz.HTTPAuthorizer already uses for the query path.
  PushBatch now requires an `authorization: Bearer <token>` gRPC
  metadata entry once a resolver is configured, fails the whole batch
  closed on a missing/invalid credential (never falls back to "no
  tenant"), and attaches the resolved tenant ID to every record as a
  `tenant_id` Kafka message header before producing it.

Verified with real round trips at every layer, no Docker needed:
rbacstore's credential CRUD (skip-gated on live Postgres, same as every
other rbacstore integration test this phase), authhandler's new
endpoint (real HTTP via httptest, including the regression test that a
session token must not validate as an ingest credential), tenantresolver
(real HTTP client against httptest, same pattern as
authz.HTTPAuthorizer's own tests), and grpcserver's PushBatch (fake
resolver/producer -- no resolver leaves messages unchanged, a configured
resolver attaches the right header or fails closed on a bad/missing
token).

Helm: ingest.requireTenantCredential (default false) is a deliberate,
separate opt-in from enterprise.enabled -- turning ENTERPRISE_AUTH_URL
on for ingest requires every agent to already hold a credential or be
refused outright, so it must not default on just because
enterprise.enabled does (same reasoning api.yaml's ENTERPRISE_AUTH_URL
isn't tied to enterprise.enabled directly either). docker-compose.yml
leaves it unset, same as ever.

Docs updated everywhere this was called "undesigned": CLAUDE.md,
docs/architecture.md, docs/security/threat-model.md (including its
summary table, now split into "identity: built" vs "write-routing: not
yet"), docs/phase-4-runbook.md (new §13), enterprise/README.md.

enterprise/cmd/enterprise-auth/main.go

@@ -79,6 +79,9 @@ func main() {
 	revokeTenant := flag.String("revoke-membership-tenant", "", "tenant id to revoke a membership from -- both -revoke-membership-* flags are required together")
 	revokeUserEmail := flag.String("revoke-membership-user-email", "", "email of the user whose tenant_memberships row to delete")
 	listMembershipsTenant := flag.String("list-memberships-tenant", "", "print every user with a membership in this tenant (id, email, display name, role) and exit")
+	createIngestCredentialTenant := flag.String("create-ingest-credential-tenant", "", "mint a new ingest bearer token for this tenant, print it once, and exit -- see ingest/internal/grpcserver.TenantResolver")
+	listIngestCredentialsTenant := flag.String("list-ingest-credentials-tenant", "", "print every ingest credential's id/created_at for this tenant (never the token itself -- only its hash is stored) and exit")
+	revokeIngestCredential := flag.String("revoke-ingest-credential", "", "delete an ingest credential by id (see -list-ingest-credentials-tenant) and exit")
 	// -healthcheck: same self-check mode as api/-healthcheck (see that
 	// binary's doc comment) -- enterprise-auth's image is distroless too.
 	healthcheck := flag.Bool("healthcheck", false, "self-check mode for Docker's HEALTHCHECK")
@@ -132,6 +135,15 @@ func main() {
 	if *listMembershipsTenant != "" {
 		os.Exit(runListMemberships(ctx, logger, rbac, *listMembershipsTenant))
 	}
+	if *createIngestCredentialTenant != "" {
+		os.Exit(runCreateIngestCredential(ctx, logger, rbac, *createIngestCredentialTenant))
+	}
+	if *listIngestCredentialsTenant != "" {
+		os.Exit(runListIngestCredentials(ctx, logger, rbac, *listIngestCredentialsTenant))
+	}
+	if *revokeIngestCredential != "" {
+		os.Exit(runRevokeIngestCredential(ctx, logger, rbac, *revokeIngestCredential))
+	}
 
 	// oidcProvider stays nil (loginhandler.RegisterRoutes then registers
 	// nothing) unless OIDC is actually configured -- matches every other
@@ -187,7 +199,7 @@ func main() {
 		OIDCEnabled: cfg.OIDC.IssuerURL != "",
 		SAMLEnabled: cfg.SAML.IDPMetadataURL != "",
 	}
-	authhandler.New(logger, sessionManager, features).RegisterRoutes(mux)
+	authhandler.New(logger, sessionManager, features, rbac).RegisterRoutes(mux)
 	loginhandler.New(logger, oidcProvider, samlProvider, sessionManager, rbac, cfg.PostLoginRedirectURL, cfg.SelectTenantRedirectURL).RegisterRoutes(mux)
 
 	srv := &http.Server{Addr: cfg.HTTPListenAddr, Handler: mux}
@@ -355,6 +367,60 @@ func runListMemberships(ctx context.Context, logger *slog.Logger, rbac *rbacstor
 	return 0
 }
 
+// runCreateIngestCredential mints a new ingest bearer token for a
+// tenant and prints it to stdout exactly once -- rbacstore only ever
+// stores its hash (see ingest_credentials's doc comment), so this
+// output is the only chance to capture the plaintext. An agent presents
+// it as an `Authorization: Bearer <token>` gRPC metadata entry on every
+// PushBatch call; ingest resolves it to a tenant via
+// POST /internal/authorize-ingest.
+func runCreateIngestCredential(ctx context.Context, logger *slog.Logger, rbac *rbacstore.Store, tenantID string) int {
+	if _, err := rbac.GetTenant(ctx, tenantID); err != nil {
+		logger.Error("looking up tenant", "tenant_id", tenantID, "error", err)
+		return 1
+	}
+	token, err := rbac.CreateIngestCredential(ctx, tenantID)
+	if err != nil {
+		logger.Error("creating ingest credential", "error", err)
+		return 1
+	}
+	fmt.Println(token)
+	return 0
+}
+
+func runListIngestCredentials(ctx context.Context, logger *slog.Logger, rbac *rbacstore.Store, tenantID string) int {
+	if _, err := rbac.GetTenant(ctx, tenantID); err != nil {
+		logger.Error("looking up tenant", "tenant_id", tenantID, "error", err)
+		return 1
+	}
+	creds, err := rbac.ListIngestCredentialsForTenant(ctx, tenantID)
+	if err != nil {
+		logger.Error("listing ingest credentials", "error", err)
+		return 1
+	}
+	if len(creds) == 0 {
+		fmt.Println("(no ingest credentials)")
+		return 0
+	}
+	for _, c := range creds {
+		fmt.Printf("%s\t%s\n", c.ID, c.CreatedAt.Format(time.RFC3339))
+	}
+	return 0
+}
+
+func runRevokeIngestCredential(ctx context.Context, logger *slog.Logger, rbac *rbacstore.Store, id string) int {
+	if err := rbac.RevokeIngestCredential(ctx, id); err != nil {
+		if err == rbacstore.ErrNotFound {
+			logger.Error("no ingest credential with this id", "id", id)
+		} else {
+			logger.Error("revoking ingest credential", "error", err)
+		}
+		return 1
+	}
+	logger.Info("revoked ingest credential", "id", id)
+	return 0
+}
+
 // runHealthcheck mirrors api/cmd/api/main.go's runHealthcheck exactly --
 // see that function's doc comment for why this execs the binary against
 // itself rather than using an external tool.