Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

alerting/internal/queryclient/client.go

@@ -23,12 +23,20 @@ type errorResponse struct {
 }
 
 type Client struct {
-	baseURL string
-	http    *http.Client
+	baseURL      string
+	serviceToken string
+	http         *http.Client
 }
 
-func New(baseURL string) *Client {
-	return &Client{baseURL: baseURL, http: &http.Client{}}
+// New builds a client for /api's POST /query. serviceToken, if non-empty,
+// is sent as a Bearer credential on every request -- api's authz
+// middleware resolves it (via enterprise-auth) to the RoleService
+// identity described in /docs/phase-4-isolation-design.md's alerting↔api
+// gap. An empty serviceToken matches Phase 0-3 behavior (no
+// enterprise/ deployed, api's authorizer is nil, every request is
+// allowed).
+func New(baseURL, serviceToken string) *Client {
+	return &Client{baseURL: baseURL, serviceToken: serviceToken, http: &http.Client{}}
 }
 
 // Query runs query (already time-range-injected by the caller, if
@@ -51,6 +59,9 @@ func (c *Client) Query(ctx context.Context, query, language string, timeout time
 		return nil, fmt.Errorf("building query request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
+	if c.serviceToken != "" {
+		req.Header.Set("Authorization", "Bearer "+c.serviceToken)
+	}
 
 	resp, err := c.http.Do(req)
 	if err != nil {