test(tenancy): prove identity read isolation (#157)

[smiggleworth]

Summary

• Add a two-tenant real-broker matrix for current tenant detail, self-list, operator member list, invitation list, and effective member access over HTTP and MCP in standalone and split API/worker modes. The scenario covers separate owners, an outsider, and the platform-operator metadata exception; it exhausts self-list and invitation cursors, requires strict rejection of a foreign invitation cursor, and asserts foreign path/filter non-disclosure.
• Record the exercised surfaces and exact limits in docs/architecture/tenant-identity-read-leak-matrix.md and index them in the central tenant read inventory. One member per tenant means member-list pagination remains unproved here; personal invitation acceptance stays in its HTTP-only lifecycle evidence. Keep [EN-01 backend] Deliver tenant authorization and actor attribution #157 open for the broader current-surface matrix and actor lifecycle acceptance.
• Correct the backend ledger after [AUTH-02a backend] Deliver verification challenges reliably #360 reclosure: 78 open and three closed backend children, feat(invitation): deliver email from recoverable worker (#183) #367 invitation and verification delivery evidence, and the untested live SMTP/production deployment limit. The foundation queue treats [R1-15 backend] Complete provisioning and tenant isolation proof #152, [EN-01 backend] Deliver tenant authorization and actor attribution #157, [R1-01 backend] Deliver tenant-scoped SOC 2 program #158, and [R1-04a backend] Activate provider-authenticated members and explain access #183 as coordinated work because EN-01 actor lifecycle proof consumes [R1-04a backend] Activate provider-authenticated members and explain access #183 identity replacement and deprovisioning.

Based on merged #372 (6a5f101f3ead7b434db61aa51e66ff52a33edad4); final head 7f29bf7d6334c4c390a88e06807dc0e6eec51f61.

Validation

• Client check — no client source changed; the Release build completed the bundled SPA build.
• Format check — dotnet format Compliance.slnx --verify-no-changes --no-restore passed.
• Release build — dotnet build Compliance.slnx -c Release --no-restore -p:EnableAotAnalyzer=true passed with zero warnings.
• Focused and nonbroker tests — tenant identity matrix passed 2/2 against the real broker after rebase; Category!=BrokerIntegration passed 595/595 on the prior head.
• Exact-head CI — run 35922937708 passed Validate, dependency review, and native AMD64/ARM64 checks.

Contracts and operations

• Authentication and authorization — positive and denied HTTP/MCP reads cover two tenants, an outsider, and an operator; self-list and invitation cursors are exhausted, and a tenant A invitation cursor is rejected under tenant B.
• API, persistence, scheduling, and wire compatibility — test and documentation only; no runtime contract, event, projection, job, or schema changes.
• Deployment and rollback — no deployment or configuration change; reverting this PR removes only evidence tests and ledger documentation.