Multi-tenancy: registry reach, links, membership and count limits over JMAP (MT-2, MT-3, MT-6, MT-7, MT-8, MT-11, MT-12, MT-17, MT-18)

Inside a tenant, server-level object types are forbidden and x:Tenant reads
return only the caller's own tenant, which it can't change. Registry writes
refuse links across tenant boundaries in both directions, give a new
principal its domain's tenant, move a domain's principals and DKIM keys with
it into a tenant, refuse moves out of a tenant while its people remain, and
refuse creates past a tenant's count limits with overQuota and
limit.tenant-quota.

crates/jmap/src/registry/query.rs

@@ -265,6 +265,14 @@ impl RegistryQuery for Server {
                     }
                 };
 
+                // inbuxa: MT-12: inside a tenant, only its own tenant object
+                let mut results = results;
+                if object_type == ObjectType::Tenant
+                    && let Some(tenant_id) = access_token.tenant_id()
+                {
+                    results.retain(|id| id.document_id() == tenant_id);
+                }
+
                 // Build response
                 let mut response = QueryResponseBuilder::new(
                     results.len(),