feat(tenants): add the tenant registry, the one enforcement point Book and Scribe now share (T-8)

A tenant has been an unchecked string since T-4/T-7: the Office's
X-Office-Tenant header or a user JWT's tatlock_user claim, with Book and
Scribe each running their own _require_tenant that checked only presence.
A typo'd claim opened a fresh, empty namespace rather than being refused.

src/domains/tenants/ (controller/models/schemas/service) adds tenants and
tenant_consumers (migration 007, down_revision="006"): tenants.id is the
slug a tatlock tenant carries, kind (household|person|test) and status
(active|suspended) CHECK-constrained; tenant_consumers is the grant pairing
a consumer to a tenant. Migration 007 seeds the two tenants in use today —
jpmschweitzer (household, "Jeroen") and llm_tester (test, "Playground") —
each granted to office-claude, the only Office consumer configured in
Authentik. Every existing owner_tenant column (book_records,
book_tenant_counters, scribe_addresses, scribe_messages,
scribe_mailbox_entries — five, grepped and confirmed) now carries a
foreign key to tenants.id, ON DELETE RESTRICT, at both the migration and
the ORM model.

TenantsService.require_tenant is the one enforcement point: no tenant is
400 tenant_required (unchanged); an unknown tenant is 403 tenant_unknown;
a suspended one is 403 tenant_suspended; an Office caller whose consumer
holds no grant in that tenant is 403 consumer_not_granted. One query — a
LEFT JOIN against the grant — so presence, status and the grant are all
read in a single round trip. Book's and Scribe's own _require_tenant now
delegate to it, translating TenantError to their own exception type so
every call site and each controller's single except clause keep working
unchanged.

Read-only this round: GET /tenants/me answers the caller's own tenant and
its granted consumers (the cheap "am I allowed here" probe); GET /tenants
answers every tenant for a tatlock/scheduler caller, or a list of one for
a tenant-bearing caller — another tenant's existence is never revealed.
No write routes; provisioning a tenant is workspace T-195.

Tests: tests/test_tenants.py and tests/test_tenants_migration.py (new);
a TestTenantRegistryEnforcement class added to both tests/test_book.py and
tests/test_scribe.py proving all four cases (unknown, suspended,
ungranted-consumer, and the control) on a live Book and Scribe route, not
only on /tenants itself. tests/conftest.py gains a tenant_registry schema
fixture and a suspended_tenant fixture (inserted and deleted per test; no
FK references it); book_schema and scribe_schema each independently grant
a second, test-environment-only consumer (office-gemini) in both seeded
tenants, since test_book.py and test_scribe.py have used it as a stand-in
second consumer since before this grant check existed — the migration
itself still seeds only office-claude, matching the dossier.

Mutation-checked: dropping the grant check fails the three
consumer_not_granted tests (200 instead of 403); dropping the status
check fails the three tenant_suspended tests; making Book bypass the
helper fails its unknown-tenant test (200 instead of 403). All three
restored and the full suite re-verified green (508 + 35 = 543 passed).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/domains/scribe/models.py

@@ -53,7 +53,10 @@ class ScribeAddress(Base):
         UniqueConstraint("owner_tenant", "name", name="uq_scribe_addresses_tenant_name"),
     )
 
-    owner_tenant: Mapped[str] = mapped_column(String(63), primary_key=True)
+    # FK to tenants.id added by migration 007 (core-api T-8).
+    owner_tenant: Mapped[str] = mapped_column(
+        String(63), ForeignKey("tenants.id", ondelete="RESTRICT"), primary_key=True
+    )
     name: Mapped[str] = mapped_column(String(63), primary_key=True)
     # Nullable: a "user"-kind caller (direct OIDC, not through the Office)
     # carries no consumer (src/domains/auth/callers.py), so an address it
@@ -82,7 +85,10 @@ class ScribeMessage(Base):
     __tablename__ = "scribe_messages"
 
     id: Mapped[int] = mapped_column(Integer, Identity(always=False), primary_key=True)
-    owner_tenant: Mapped[str] = mapped_column(String(63), nullable=False, index=True)
+    # FK to tenants.id added by migration 007 (core-api T-8).
+    owner_tenant: Mapped[str] = mapped_column(
+        String(63), ForeignKey("tenants.id", ondelete="RESTRICT"), nullable=False, index=True
+    )
     topics: Mapped[List[str]] = mapped_column(ARRAY(Text), nullable=False, default=list)
     from_identity: Mapped[str] = mapped_column(String(63), nullable=False)
     from_consumer: Mapped[Optional[str]] = mapped_column(String(63), nullable=True)
@@ -120,7 +126,10 @@ class ScribeMailboxEntry(Base):
 
     id: Mapped[int] = mapped_column(Integer, Identity(always=False), primary_key=True)
     address: Mapped[str] = mapped_column(String(63), nullable=False)
-    owner_tenant: Mapped[str] = mapped_column(String(63), nullable=False)
+    # FK to tenants.id added by migration 007 (core-api T-8).
+    owner_tenant: Mapped[str] = mapped_column(
+        String(63), ForeignKey("tenants.id", ondelete="RESTRICT"), nullable=False
+    )
     message_id: Mapped[int] = mapped_column(
         Integer, ForeignKey("scribe_messages.id"), nullable=False
     )