Multi-tenancy: registry reach, links, membership and count limits over JMAP (MT-2, MT-3, MT-6, MT-7, MT-8, MT-11, MT-12, MT-17, MT-18)

Inside a tenant, server-level object types are forbidden and x:Tenant reads
return only the caller's own tenant, which it can't change. Registry writes
refuse links across tenant boundaries in both directions, give a new
principal its domain's tenant, move a domain's principals and DKIM keys with
it into a tenant, refuse moves out of a tenant while its people remain, and
refuse creates past a tenant's count limits with overQuota and
limit.tenant-quota.

crates/jmap/src/registry/get.rs

@@ -198,6 +198,11 @@ impl RegistryGet for Server {
 
                 let ids = if let Some(ids) = get.ids.take() {
                     ids
+                } else if object_type == ObjectType::Tenant
+                    && let Some(tenant_id) = access_token.tenant_id()
+                {
+                    // inbuxa: MT-12: inside a tenant, only its own tenant object
+                    vec![Id::from(tenant_id)]
                 } else {
                     self.registry()
                         .query::<Vec<Id>>(
@@ -223,6 +228,11 @@ impl RegistryGet for Server {
                                 != object.inner.member_tenant_id())
                             || (is_account_filtered
                                 && object.inner.account_id() != Some(Id::from(get.account_id)))
+                            // inbuxa: MT-12: inside a tenant, only its own tenant object
+                            || (object_type == ObjectType::Tenant
+                                && access_token
+                                    .tenant_id()
+                                    .is_some_and(|tenant_id| tenant_id != id.document_id()))
                         {
                             get.not_found(id);
                             continue;