Add tenant provisioning and provisioning hooks

[suchait007]

Closes #11. Closes #6.

provisioning.onboard(account.slug());   // from your signup path — a call, not a deploy

The order is the design

registry row, PROVISIONING   the tenant exists; nothing serves it yet
migrate                      its schema or database, when the strategy needs one
hooks                        seed data and everything application-specific
registry row, ACTIVE         now it is served

A tenant marked ACTIVE before its hooks have run is briefly live and broken.

Why hooks run with the tenant bound

This is the bug the feature exists to remove. Onboarding was a three-step recipe every adopter wrote by hand, and step three is the one they got wrong — seed data written with no tenant bound fails the policy under row-level security and has no connection at all under database-per-tenant. So onboarding half-succeeded.

A hook now writes seed data with ordinary repository calls and no tenant parameter.

PROVISIONING, and why it exists

A half-created tenant that is absent looks like one nobody asked for. One left ACTIVE looks ready and is not. PROVISIONING is neither: not served, skipped by forEachTenant, and the exception names the hook that failed.

Onboarding is idempotent, so retrying is just calling it again — which means hooks must tolerate running twice, documented rather than assumed.

Scope, stated honestly

onboard provisions this service. It cannot reach the other nineteen in an estate, and an API pretending otherwise would lie. Under row-level security they have nothing to do anyway — the tables are shared. The docs describe the control-plane pattern and the three coordination options rather than inventing one.

TenantMigrationRunner now exposes migratesPerTenant(), so onboarding skips Flyway entirely under a shared store rather than starting it to discover there is nothing to apply.

Verification

mutation	result
mark ACTIVE up front	3 tests failed
run hooks without binding the tenant	2 failed
carry on after a hook fails	3 failed
drop idempotency	1 failed
ignore hook ordering	1 failed

Reverts confirmed in compiled bytecode.

Library 161 green. order-service 39 green, including three where the seeding hook writes through the real repository — an insert the policy rejects unless provisioning bound the tenant. Removing that binding fails the consumer suite, which I verified rather than assumed.

Docs: docs/onboarding.md.

Note: adds PROVISIONING to TenantStatus, which #34 also touches. Small overlap, trivial to resolve, and they compose correctly — #34 refuses non-ACTIVE tenants, which is exactly the right treatment for one still provisioning.