Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

api/searchclient/client.go

@@ -0,0 +1,46 @@
+// Package searchclient adapts the generated gRPC SearchServiceClient to
+// the narrow querylang/executor.SearchClient interface (Search(ctx,
+// query string, limit uint32) ([]string, error), satisfied structurally,
+// no adapter type needed), so the query executor doesn't need to know
+// anything about gRPC/protobuf directly.
+package searchclient
+
+import (
+	"context"
+	"fmt"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	searchv1 "github.com/sentry/sentry/proto/sentry/search/v1"
+)
+
+type Client struct {
+	grpc searchv1.SearchServiceClient
+	conn *grpc.ClientConn
+}
+
+// Dial connects to the search service. Plain TCP, no TLS: internal
+// service-to-service traffic (api <-> search), same trust boundary as
+// api's existing plain-TCP connection to ClickHouse -- mTLS in this
+// project is specifically the agent<->ingest edge boundary, not every
+// internal hop.
+func Dial(addr string) (*Client, error) {
+	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, fmt.Errorf("dialing search service at %s: %w", addr, err)
+	}
+	return &Client{grpc: searchv1.NewSearchServiceClient(conn), conn: conn}, nil
+}
+
+func (c *Client) Close() error {
+	return c.conn.Close()
+}
+
+func (c *Client) Search(ctx context.Context, query string, limit uint32) ([]string, error) {
+	resp, err := c.grpc.Search(ctx, &searchv1.SearchRequest{Query: query, Limit: limit})
+	if err != nil {
+		return nil, err
+	}
+	return resp.GetRecordIds(), nil
+}