Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

alerting/internal/queryclient/client_test.go

@@ -0,0 +1,46 @@
+package queryclient
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestQuerySendsBearerServiceToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"columns":[],"rows":[]}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "service-token-xyz")
+	if _, err := c.Query(t.Context(), "stats count", "spl", time.Second); err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	if gotAuth != "Bearer service-token-xyz" {
+		t.Fatalf("Authorization header = %q, want Bearer service-token-xyz", gotAuth)
+	}
+}
+
+func TestQueryOmitsAuthorizationWhenNoTokenConfigured(t *testing.T) {
+	var gotAuth string
+	sawHeader := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		sawHeader = r.Header.Get("Authorization") != ""
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"columns":[],"rows":[]}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "")
+	if _, err := c.Query(t.Context(), "stats count", "spl", time.Second); err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	if sawHeader {
+		t.Fatalf("expected no Authorization header when no service token is configured, got %q", gotAuth)
+	}
+}