Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)

Closes the last named "isolation mechanism" gap: search.proto gains a
tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry
resolves it to an on-demand-opened, per-tenant Tantivy index (empty
tenant_id keeps today's single default index, so this is purely
additive); enterprise/internal/searchclient sets that field from the
authenticated request identity in ctx, mirroring chrunner's exact
fail-closed "never a parameter" shape. Wired into enterprise-api in
place of the shared api/searchclient.

Unlike the ClickHouse pieces from the previous two commits, this one is
genuinely verified end to end in this environment: Tantivy is an
embedded library, not a networked service, so both the Rust index
registry (cargo test, cargo clippy --all-targets -- -D warnings, both
clean) and the Go client (a real in-process gRPC server) could actually
run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants
seeds three real indices with the same term and confirms a tenant-scoped
search returns only that tenant's document -- item 3 of the isolation
design doc's verification plan, closed for real, not just written.

With both ClickHouse and Tantivy isolation now built, the single largest
remaining gap is no longer a missing mechanism: it's that nothing forces
or flags whether a deployment actually runs enterprise-api instead of
plain api, and that ingest itself has no tenant concept for either
storage engine (every record still lands in the one shared database/
index no matter what -- undesigned, not just unbuilt). Updated the
threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.

proto/sentry/search/v1/search.proto

@@ -22,6 +22,17 @@ message SearchRequest {
 
   // Max results to return. 0 (unset) uses the service's own default.
   uint32 limit = 2;
+
+  // tenant_id (Phase 4) selects which per-tenant Tantivy index to search
+  // -- resolved server-side by the caller (enterprise/internal/
+  // searchclient, from the authenticated identity in request context),
+  // never a value a browser/client supplies directly. Empty selects the
+  // single default index every Phase 0-3 deployment (and every
+  // ingest-written record today, regardless of tenant -- see
+  // /docs/security/threat-model.md's ingest-tenancy caveat) already
+  // uses, so this field is purely additive: an old caller that never
+  // sets it keeps today's behavior exactly.
+  string tenant_id = 3;
 }
 
 message SearchResponse {