feat: multi-tenant controls (authz hooks, quotas, isolation)

[catgoose]

Split from #142.

For SaaS use cases, tavern needs tenant-aware operational controls.

Scope

• Publisher authorization hooks (who can publish to which topics)
• Per-tenant rate limits / quotas
• Tenant isolation (ensure one tenant's traffic doesn't starve another)
• Per-tenant retention policies

Context

Scoped subscriptions (SubscribeScoped / PublishTo) already provide per-tenant message delivery. This issue is about the operational controls around that — preventing abuse, enforcing limits, and ensuring fair resource sharing.