Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

api/cmd/api/main.go

@@ -1,7 +1,7 @@
 // Command api is Sentry's query API: a single POST /query endpoint
 // accepting either the pipe syntax or raw SQL, compiled and routed
 // across ClickHouse and search by internal/querylang. See
-// internal/queryapi and /docs/query-language-design.md for why this is
+// queryapi and /docs/query-language-design.md for why this is
 // plain REST rather than the pinned gRPC+gateway pattern.
 package main
 
@@ -19,13 +19,13 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/jackc/pgx/v5/pgxpool"
 
-	"github.com/sentry/sentry/api/internal/authz"
+	"github.com/sentry/sentry/api/authz"
+	"github.com/sentry/sentry/api/dashboards"
+	"github.com/sentry/sentry/api/httpserver"
 	"github.com/sentry/sentry/api/internal/config"
-	"github.com/sentry/sentry/api/internal/dashboards"
-	"github.com/sentry/sentry/api/internal/httpserver"
-	"github.com/sentry/sentry/api/internal/queryapi"
-	"github.com/sentry/sentry/api/internal/querylang/executor"
-	"github.com/sentry/sentry/api/internal/searchclient"
+	"github.com/sentry/sentry/api/queryapi"
+	"github.com/sentry/sentry/api/querylang/executor"
+	"github.com/sentry/sentry/api/searchclient"
 )
 
 func main() {
@@ -104,7 +104,7 @@ func main() {
 	dashboardsHandler := dashboards.NewHandler(logger, dashboards.NewStore(pgPool), authorizer)
 
 	// One shared mux, CORS applied once around the whole thing -- see
-	// internal/httpserver's doc comment for why this changed from each
+	// httpserver's doc comment for why this changed from each
 	// handler wrapping itself individually.
 	mux := http.NewServeMux()
 	queryHandler.RegisterRoutes(mux)