Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)

Closes the last named "isolation mechanism" gap: search.proto gains a
tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry
resolves it to an on-demand-opened, per-tenant Tantivy index (empty
tenant_id keeps today's single default index, so this is purely
additive); enterprise/internal/searchclient sets that field from the
authenticated request identity in ctx, mirroring chrunner's exact
fail-closed "never a parameter" shape. Wired into enterprise-api in
place of the shared api/searchclient.

Unlike the ClickHouse pieces from the previous two commits, this one is
genuinely verified end to end in this environment: Tantivy is an
embedded library, not a networked service, so both the Rust index
registry (cargo test, cargo clippy --all-targets -- -D warnings, both
clean) and the Go client (a real in-process gRPC server) could actually
run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants
seeds three real indices with the same term and confirms a tenant-scoped
search returns only that tenant's document -- item 3 of the isolation
design doc's verification plan, closed for real, not just written.

With both ClickHouse and Tantivy isolation now built, the single largest
remaining gap is no longer a missing mechanism: it's that nothing forces
or flags whether a deployment actually runs enterprise-api instead of
plain api, and that ingest itself has no tenant concept for either
storage engine (every record still lands in the one shared database/
index no matter what -- undesigned, not just unbuilt). Updated the
threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.

enterprise/internal/searchclient/searchclient_test.go

@@ -0,0 +1,114 @@
+// Tests run a real gRPC server in-process (net.Listen on an ephemeral
+// port, a real grpc.Server) implementing SearchServiceServer, so these
+// exercise the actual wire protocol Client.Search sends, not a mocked
+// interface -- proving TenantId is set on the real SearchRequest that
+// would reach `search`, and that Client fails closed exactly the way
+// enterprise/internal/chrunner.Registry.RunSQL does for ClickHouse.
+package searchclient
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"google.golang.org/grpc"
+
+	"github.com/sentry/sentry/api/authz"
+	searchv1 "github.com/sentry/sentry/proto/sentry/search/v1"
+)
+
+type fakeSearchServer struct {
+	searchv1.UnimplementedSearchServiceServer
+	lastRequest *searchv1.SearchRequest
+	recordIDs   []string
+}
+
+func (f *fakeSearchServer) Search(_ context.Context, req *searchv1.SearchRequest) (*searchv1.SearchResponse, error) {
+	f.lastRequest = req
+	return &searchv1.SearchResponse{RecordIds: f.recordIDs}, nil
+}
+
+func newTestServer(t *testing.T) (*Client, *fakeSearchServer) {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listening: %v", err)
+	}
+	fake := &fakeSearchServer{recordIDs: []string{"id-1", "id-2"}}
+	srv := grpc.NewServer()
+	searchv1.RegisterSearchServiceServer(srv, fake)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	client, err := Dial(lis.Addr().String())
+	if err != nil {
+		t.Fatalf("Dial: %v", err)
+	}
+	t.Cleanup(func() { _ = client.Close() })
+	return client, fake
+}
+
+func TestSearchForwardsTenantIDFromContext(t *testing.T) {
+	client, fake := newTestServer(t)
+	ctx := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "acme", Role: authz.RoleViewer})
+
+	ids, err := client.Search(ctx, "error", 10)
+	if err != nil {
+		t.Fatalf("Search: %v", err)
+	}
+	if len(ids) != 2 {
+		t.Fatalf("got %d record ids, want 2", len(ids))
+	}
+	if fake.lastRequest.TenantId != "acme" {
+		t.Fatalf("TenantId sent to search = %q, want acme", fake.lastRequest.TenantId)
+	}
+	if fake.lastRequest.Query != "error" || fake.lastRequest.Limit != 10 {
+		t.Fatalf("unexpected request: %+v", fake.lastRequest)
+	}
+}
+
+func TestSearchRefusesWithNoIdentity(t *testing.T) {
+	client, fake := newTestServer(t)
+
+	if _, err := client.Search(context.Background(), "error", 10); err == nil {
+		t.Fatal("expected Search to refuse a request with no authenticated identity in context")
+	}
+	if fake.lastRequest != nil {
+		t.Fatal("expected the gRPC call to never reach the server when there's no identity")
+	}
+}
+
+func TestSearchRefusesIdentityWithNoTenant(t *testing.T) {
+	client, fake := newTestServer(t)
+	// RoleService identities carry no TenantID -- see api/authz.Identity's
+	// doc comment. /alerting never calls search directly today, but the
+	// fail-closed behavior must hold regardless of how this arises.
+	ctx := authz.WithIdentity(context.Background(), authz.Identity{Role: authz.RoleService})
+
+	if _, err := client.Search(ctx, "error", 10); err == nil {
+		t.Fatal("expected Search to refuse an identity with no tenant")
+	}
+	if fake.lastRequest != nil {
+		t.Fatal("expected the gRPC call to never reach the server when the identity has no tenant")
+	}
+}
+
+func TestSearchDifferentTenantsSendDifferentTenantIDs(t *testing.T) {
+	client, fake := newTestServer(t)
+
+	ctxA := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "acme", Role: authz.RoleViewer})
+	if _, err := client.Search(ctxA, "q", 5); err != nil {
+		t.Fatalf("Search (acme): %v", err)
+	}
+	if fake.lastRequest.TenantId != "acme" {
+		t.Fatalf("TenantId = %q, want acme", fake.lastRequest.TenantId)
+	}
+
+	ctxB := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "globex", Role: authz.RoleViewer})
+	if _, err := client.Search(ctxB, "q", 5); err != nil {
+		t.Fatalf("Search (globex): %v", err)
+	}
+	if fake.lastRequest.TenantId != "globex" {
+		t.Fatalf("TenantId = %q, want globex", fake.lastRequest.TenantId)
+	}
+}