Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

deploy/operator/api/v1alpha1/groupversion_info.go

@@ -0,0 +1,27 @@
+// Package v1alpha1 contains the Tenant API's Go types -- kubebuilder's
+// standard api/<version>/ layout, hand-written rather than scaffolded
+// (no kubebuilder/controller-gen binary available in this environment;
+// see /home/john/Projects/sentry/deploy/README.md's verification
+// section for what that means for this package specifically: it's real,
+// compiling, unit-tested Go code, never reconciled against a live
+// cluster).
+//
+// +kubebuilder:object:generate=true
+// +groupName=sentry.io
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group sentry.io, version v1alpha1.
+	GroupVersion = schema.GroupVersion{Group: "sentry.io", Version: "v1alpha1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)