feat(auth): user-scoped tenant discovery for tenant switchers (ADR-0011) - #21

Stacked on #19 — merge that first, then this (base is its branch so the diff stays scoped).

What

Two endpoints answering which sibling tenants may the proven visiting user reach, powering an in-product tenant switcher with Watchtower as the identity provider for the apps it proxies:

• GET /api/app/tenants/accessible — for the product UI itself (a tenant stack): accessible siblings of its own template as slug + domain, the caller marked current when it appears.
• GET /api/mgmt/templates/{id}/tenants/accessible — the same user-filtered view for a granted management stack (its unfiltered operations list is unchanged).

How the user is proven

The caller forwards the visitor's X-Watchtower-Jwt (already delivered on every proxied request) alongside its own wtapp_ token. A new audience-validating AuthTokenSigner overload requires the JWT's aud to match one of the calling stack's own route domains (custom AudienceValidator, case-insensitive; empty set fails closed) — so an app can only ask about users actively visiting it, and a JWT leaked to another app is inert. The user row is then re-read, refusing disabled accounts within the 5-minute token window. Every assertion failure yields one uniform 401.

Access per sibling follows the central-auth policy on its primary route — Public/Authenticated pass, Restricted needs a RouteAccessGrant, unknown modes fail closed — via a new bulk RouteAccessPolicy.AccessibleRouteIdsAsync (one grants query per template).

Reviewer notes

• ADR-0011 records this as the single scoped amendment to ADR-0008's "a stack can only ever see itself"; ADR-0008/0009 gained pointers.
• The slug accessible is now reserved at provisioning — it would collide with the literal route segment.
• Both endpoints are 404 when central auth is off (UserInfo precedent).
• The caller's own row is honestly filtered like any sibling, so current may be absent — documented.
• 31 new tests: wrong-audience, alg-confusion-carrying-correct-aud, routeless caller, disabled user, fail-closed unknown mode, uniform-401 body equality, cross-template isolation.

Verification

dotnet build Release 0 warnings · 355 tests green · no rpc-schema.json drift · npm run build clean.