feat(server): tenant-aware write paths and pluggable tenant resolver (4/7)

[abhinav-galileo]

Stacked on top of #181. Kept in draft until the full stack has been validated end-to-end.

Summary

• Introduces TenantResolver Protocol and HeaderTenantResolver default implementation in tenancy.py.
• set_tenant_resolver(...) lets deployments with their own tenant identity source (e.g. auth claims) swap in an alternative resolver at startup.
• Agent (initAgent), control (create_control), and policy (create_policy) creation now persist the resolved tenant explicitly instead of relying solely on the DB default.
• Association inserts into agent_policies and agent_controls record the owning agent's tenant_id, not the request-scoped one. This keeps association rows consistent with the parent agent under all tenant mechanisms.
• Read paths remain unscoped (matches the stance from the bottom of the stack).

Design notes

• The resolver seam is intentionally small: one method, resolve(x_tenant_id). This keeps the OSS code free of auth-specific types and lets extensions grow without forcing OSS code to adopt them.
• The process-wide resolver is installed once at startup. Tests that swap it via a fixture restore the prior resolver in teardown.
• Default behavior is unchanged: no header -> default-tenant.

Intentional non-goals (deferred)

• Tenant-scoped reads on agent/control/policy endpoints. Still out of scope because it would require changing primary keys or adding tenant predicates to many existing queries.
• Removing global uniqueness on Agent.name, Control.name, Policy.name. Cross-tenant name collisions still apply. Tests use distinct names per tenant rather than depending on tenant-scoped uniqueness.
• Specific auth-driven resolver implementations.

Test plan

• make check clean locally (562 server tests including 9 new)
• New coverage:
  • Writes without a header land in default-tenant for agent/control/policy
  • Writes with X-Tenant-Id land in the resolved tenant
  • agent_policies / agent_controls rows inherit the agent's tenant_id
  • Whitespace header normalizes to default-tenant
  • TenantResolver Protocol is runtime-checkable
  • Installed resolver override is honored by the dependency
• All existing tests pass unmodified (behavior preservation)
• Validated on integration branch with PR1-PR4 merged

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!