Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

api/authz/httpauthz_test.go

@@ -0,0 +1,72 @@
+package authz
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestHTTPAuthorizerForwardsCredentialsAndParsesIdentity(t *testing.T) {
+	var gotCookie, gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotCookie = r.Header.Get("Cookie")
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(authorizeResponse{TenantID: "acme", UserID: "u1", Role: "editor"})
+	}))
+	defer srv.Close()
+
+	a := NewHTTPAuthorizer(srv.URL)
+	incoming := httptest.NewRequest(http.MethodPost, "/query", nil)
+	incoming.Header.Set("Cookie", "sentry_session=abc123")
+	incoming.Header.Set("Authorization", "Bearer service-token-xyz")
+
+	identity, err := a.Authorize(incoming)
+	if err != nil {
+		t.Fatalf("Authorize: %v", err)
+	}
+	if identity.TenantID != "acme" || identity.UserID != "u1" || identity.Role != RoleEditor {
+		t.Fatalf("unexpected identity: %+v", identity)
+	}
+	if gotCookie != "sentry_session=abc123" {
+		t.Fatalf("Cookie header not forwarded, got %q", gotCookie)
+	}
+	if gotAuth != "Bearer service-token-xyz" {
+		t.Fatalf("Authorization header not forwarded, got %q", gotAuth)
+	}
+}
+
+func TestHTTPAuthorizerNon2xxIsAnError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	a := NewHTTPAuthorizer(srv.URL)
+	_, err := a.Authorize(httptest.NewRequest(http.MethodPost, "/query", nil))
+	if err == nil {
+		t.Fatalf("expected an error for a 401 response from enterprise-auth")
+	}
+}
+
+func TestHTTPAuthorizerDoesNotForwardUnrelatedHeaders(t *testing.T) {
+	var gotXForwarded string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotXForwarded = r.Header.Get("X-Forwarded-For")
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(authorizeResponse{Role: "viewer"})
+	}))
+	defer srv.Close()
+
+	a := NewHTTPAuthorizer(srv.URL)
+	incoming := httptest.NewRequest(http.MethodPost, "/query", nil)
+	incoming.Header.Set("X-Forwarded-For", "1.2.3.4")
+
+	if _, err := a.Authorize(incoming); err != nil {
+		t.Fatalf("Authorize: %v", err)
+	}
+	if gotXForwarded != "" {
+		t.Fatalf("expected only Cookie/Authorization to be forwarded, but X-Forwarded-For leaked through as %q", gotXForwarded)
+	}
+}