Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)

Closes the last named "isolation mechanism" gap: search.proto gains a
tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry
resolves it to an on-demand-opened, per-tenant Tantivy index (empty
tenant_id keeps today's single default index, so this is purely
additive); enterprise/internal/searchclient sets that field from the
authenticated request identity in ctx, mirroring chrunner's exact
fail-closed "never a parameter" shape. Wired into enterprise-api in
place of the shared api/searchclient.

Unlike the ClickHouse pieces from the previous two commits, this one is
genuinely verified end to end in this environment: Tantivy is an
embedded library, not a networked service, so both the Rust index
registry (cargo test, cargo clippy --all-targets -- -D warnings, both
clean) and the Go client (a real in-process gRPC server) could actually
run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants
seeds three real indices with the same term and confirms a tenant-scoped
search returns only that tenant's document -- item 3 of the isolation
design doc's verification plan, closed for real, not just written.

With both ClickHouse and Tantivy isolation now built, the single largest
remaining gap is no longer a missing mechanism: it's that nothing forces
or flags whether a deployment actually runs enterprise-api instead of
plain api, and that ingest itself has no tenant concept for either
storage engine (every record still lands in the one shared database/
index no matter what -- undesigned, not just unbuilt). Updated the
threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.

search/src/grpc.rs

@@ -1,18 +1,18 @@
 use std::sync::Arc;
 use tonic::{Request, Response, Status};
 
-use crate::index::SearchIndex;
+use crate::registry::IndexRegistry;
 use crate::searchv1;
 
 const DEFAULT_LIMIT: usize = 100;
 
 pub struct SearchServer {
-    index: Arc<SearchIndex>,
+    registry: Arc<IndexRegistry>,
 }
 
 impl SearchServer {
-    pub fn new(index: Arc<SearchIndex>) -> Self {
-        Self { index }
+    pub fn new(registry: Arc<IndexRegistry>) -> Self {
+        Self { registry }
     }
 }
 
@@ -33,7 +33,17 @@ impl searchv1::search_service_server::SearchService for SearchServer {
             req.limit as usize
         };
 
-        let index = Arc::clone(&self.index);
+        // Resolves (opening on first use) the caller's tenant index, or
+        // the single default index when tenant_id is empty -- see
+        // registry.rs's doc comment. Never falls back to a *different*
+        // tenant's index on error; an unsafe/unknown tenant_id is a
+        // hard failure, not a silent default.
+        let index = self
+            .registry
+            .resolve(&req.tenant_id)
+            .await
+            .map_err(|e| Status::invalid_argument(format!("resolving tenant index: {e}")))?;
+
         let query = req.query.clone();
         // Tantivy's searcher is synchronous; run it on a blocking thread
         // so it doesn't stall the async runtime alongside the consumer