Tenants

Read-only roster of registered tenants. KMS key references are redacted at the API layer — the raw key ref never leaves the engine process.