Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

api/internal/config/config.go

@@ -16,6 +16,7 @@ type Config struct {
 	SearchGRPCAddr    string
 	QueryTimeout      time.Duration
 	CORSAllowedOrigin string
+	EnterpriseAuthURL string
 }
 
 type ClickHouseConfig struct {
@@ -58,6 +59,12 @@ func Load() (Config, error) {
 		// working out of the box. Tighten before this is ever reachable
 		// from outside a trusted dev/homelab network.
 		CORSAllowedOrigin: getenv("CORS_ALLOWED_ORIGIN", "*"),
+		// Empty by default -- a single-tenant deployment without
+		// enterprise/ configured runs with authz.RequireRole* as a
+		// no-op, matching Phase 0-3 behavior. Set to enterprise-auth's
+		// base URL (e.g. "http://enterprise-auth:8081") to turn on
+		// real session/service-token enforcement.
+		EnterpriseAuthURL: getenv("ENTERPRISE_AUTH_URL", ""),
 	}
 
 	timeoutSec, err := strconv.Atoi(getenv("QUERY_TIMEOUT_SECONDS", "30"))