Multi-tenant UI and per-app permissions

[inerc]

The storage schema has carried tenant_id since day one; the UI and API
currently serve the default tenant only, and roles are global
(admin/member). This issue tracks the next access-control step.

Scope (to be refined by demand)

• multiple tenants end-to-end: ingest tagging, per-tenant query/tail/
  topology isolation, tenant switcher in the UI;
• fine-grained permissions: per-app visibility for members (e.g. a team
  sees only its services and their neighborhood on the map);
• tokens scoped to a tenant/app set.

Why

Requested boundary for larger installations; the single-tenant default
stays zero-config.