Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)

Closes the last named "isolation mechanism" gap: search.proto gains a
tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry
resolves it to an on-demand-opened, per-tenant Tantivy index (empty
tenant_id keeps today's single default index, so this is purely
additive); enterprise/internal/searchclient sets that field from the
authenticated request identity in ctx, mirroring chrunner's exact
fail-closed "never a parameter" shape. Wired into enterprise-api in
place of the shared api/searchclient.

Unlike the ClickHouse pieces from the previous two commits, this one is
genuinely verified end to end in this environment: Tantivy is an
embedded library, not a networked service, so both the Rust index
registry (cargo test, cargo clippy --all-targets -- -D warnings, both
clean) and the Go client (a real in-process gRPC server) could actually
run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants
seeds three real indices with the same term and confirms a tenant-scoped
search returns only that tenant's document -- item 3 of the isolation
design doc's verification plan, closed for real, not just written.

With both ClickHouse and Tantivy isolation now built, the single largest
remaining gap is no longer a missing mechanism: it's that nothing forces
or flags whether a deployment actually runs enterprise-api instead of
plain api, and that ingest itself has no tenant concept for either
storage engine (every record still lands in the one shared database/
index no matter what -- undesigned, not just unbuilt). Updated the
threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.

search/src/main.rs

@@ -3,6 +3,7 @@ mod consumer;
 mod grpc;
 mod index;
 mod offsets;
+mod registry;
 
 pub mod logsv1 {
     tonic::include_proto!("sentry.logs.v1");
@@ -14,6 +15,7 @@ pub mod searchv1 {
 use anyhow::{Context, Result};
 use config::Config;
 use index::SearchIndex;
+use registry::IndexRegistry;
 use std::sync::Arc;
 use tonic::transport::Server;
 
@@ -33,6 +35,12 @@ async fn main() -> Result<()> {
     let index = Arc::new(
         SearchIndex::open_or_create(&cfg.index_path).context("opening tantivy index")?,
     );
+    // Per-tenant indices (Phase 4) are resolved on demand by
+    // IndexRegistry, opened under cfg.tenants_index_path -- see
+    // registry.rs's doc comment for what this does and doesn't isolate
+    // yet (read-side only; the consumer below still only ever writes
+    // into the single default `index` above).
+    let registry = Arc::new(IndexRegistry::new(Arc::clone(&index), cfg.tenants_index_path.clone()));
 
     let partition_count: i32 = std::env::var("REDPANDA_TOPIC_PARTITIONS")
         .ok()
@@ -53,7 +61,7 @@ async fn main() -> Result<()> {
         .context("parsing GRPC_LISTEN_ADDR")?;
     tracing::info!(addr = %cfg.grpc_listen_addr, "search gRPC server listening");
 
-    let search_server = grpc::SearchServer::new(Arc::clone(&index));
+    let search_server = grpc::SearchServer::new(Arc::clone(&registry));
     Server::builder()
         .add_service(searchv1::search_service_server::SearchServiceServer::new(
             search_server,