Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)

Closes the last named "isolation mechanism" gap: search.proto gains a
tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry
resolves it to an on-demand-opened, per-tenant Tantivy index (empty
tenant_id keeps today's single default index, so this is purely
additive); enterprise/internal/searchclient sets that field from the
authenticated request identity in ctx, mirroring chrunner's exact
fail-closed "never a parameter" shape. Wired into enterprise-api in
place of the shared api/searchclient.

Unlike the ClickHouse pieces from the previous two commits, this one is
genuinely verified end to end in this environment: Tantivy is an
embedded library, not a networked service, so both the Rust index
registry (cargo test, cargo clippy --all-targets -- -D warnings, both
clean) and the Go client (a real in-process gRPC server) could actually
run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants
seeds three real indices with the same term and confirms a tenant-scoped
search returns only that tenant's document -- item 3 of the isolation
design doc's verification plan, closed for real, not just written.

With both ClickHouse and Tantivy isolation now built, the single largest
remaining gap is no longer a missing mechanism: it's that nothing forces
or flags whether a deployment actually runs enterprise-api instead of
plain api, and that ingest itself has no tenant concept for either
storage engine (every record still lands in the one shared database/
index no matter what -- undesigned, not just unbuilt). Updated the
threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.

proto/sentry/search/v1/search.pb.go

@@ -29,7 +29,17 @@ type SearchRequest struct {
 	// and doesn't support in Phase 1.
 	Query string `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
 	// Max results to return. 0 (unset) uses the service's own default.
-	Limit         uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
+	Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
+	// tenant_id (Phase 4) selects which per-tenant Tantivy index to search
+	// -- resolved server-side by the caller (enterprise/internal/
+	// searchclient, from the authenticated identity in request context),
+	// never a value a browser/client supplies directly. Empty selects the
+	// single default index every Phase 0-3 deployment (and every
+	// ingest-written record today, regardless of tenant -- see
+	// /docs/security/threat-model.md's ingest-tenancy caveat) already
+	// uses, so this field is purely additive: an old caller that never
+	// sets it keeps today's behavior exactly.
+	TenantId      string `protobuf:"bytes,3,opt,name=tenant_id,json=tenantId,proto3" json:"tenant_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -78,6 +88,13 @@ func (x *SearchRequest) GetLimit() uint32 {
 	return 0
 }
 
+func (x *SearchRequest) GetTenantId() string {
+	if x != nil {
+		return x.TenantId
+	}
+	return ""
+}
+
 type SearchResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// record_ids of matching logs, most-relevant first. Callers join these
@@ -130,10 +147,11 @@ var File_sentry_search_v1_search_proto protoreflect.FileDescriptor
 
 const file_sentry_search_v1_search_proto_rawDesc = "" +
 	"\n" +
-	"\x1dsentry/search/v1/search.proto\x12\x10sentry.search.v1\";\n" +
+	"\x1dsentry/search/v1/search.proto\x12\x10sentry.search.v1\"X\n" +
 	"\rSearchRequest\x12\x14\n" +
 	"\x05query\x18\x01 \x01(\tR\x05query\x12\x14\n" +
-	"\x05limit\x18\x02 \x01(\rR\x05limit\"/\n" +
+	"\x05limit\x18\x02 \x01(\rR\x05limit\x12\x1b\n" +
+	"\ttenant_id\x18\x03 \x01(\tR\btenantId\"/\n" +
 	"\x0eSearchResponse\x12\x1d\n" +
 	"\n" +
 	"record_ids\x18\x01 \x03(\tR\trecordIds2\\\n" +

proto/sentry/search/v1/search.proto

@@ -22,6 +22,17 @@ message SearchRequest {
 
   // Max results to return. 0 (unset) uses the service's own default.
   uint32 limit = 2;
+
+  // tenant_id (Phase 4) selects which per-tenant Tantivy index to search
+  // -- resolved server-side by the caller (enterprise/internal/
+  // searchclient, from the authenticated identity in request context),
+  // never a value a browser/client supplies directly. Empty selects the
+  // single default index every Phase 0-3 deployment (and every
+  // ingest-written record today, regardless of tenant -- see
+  // /docs/security/threat-model.md's ingest-tenancy caveat) already
+  // uses, so this field is purely additive: an old caller that never
+  // sets it keeps today's behavior exactly.
+  string tenant_id = 3;
 }
 
 message SearchResponse {