feat(server): tenant-registry skeleton boots against dev stack

Minimal Go service so platform/portal has something to resolve in local
dev. Stdlib net/http with Go 1.22 enhanced ServeMux (method+path
patterns); no third-party deps yet.

Layout:
  cmd/server/main.go               entry point with graceful shutdown
  internal/config/                 env-driven config (APP_ENV, ADDR, KC issuer)
  internal/server/                 http handlers + request-logging middleware
  internal/store/memory.go         in-memory tenant store, seeded with acme
  migrations/0001_init.up.sql      schema for the M4.1 follow-up (unapplied)
  Makefile                         dev/test/build/lint/docker targets
  Dockerfile                       multi-stage distroless build

Endpoints (under :8080 in dev):
  GET /healthz
  GET /v1/tenants/by-slug/{slug}   200 acme | 404
  GET /v1/tenants/{id}             200 by uuid | 404

JWT validation and the real Postgres-backed store land in the M4.1
follow-up PR — keeping this PR strictly to 'boots, replies, tests pass'.

Refs: M4.1 (skeleton)

Makefile

@@ -0,0 +1,41 @@
+# tenant-registry — Go service for tenant glue, audit, API keys.
+
+.PHONY: help dev test build fmt vet lint docker clean
+
+ADDR ?= :8080
+APP_ENV ?= dev
+
+help:
+	@echo "tenant-registry targets:"
+	@echo "  make dev         go run ./cmd/server (foreground, APP_ENV=dev)"
+	@echo "  make test        go test -race ./..."
+	@echo "  make build       compile binary to ./bin/tenant-registry"
+	@echo "  make fmt         go fmt ./..."
+	@echo "  make vet         go vet ./..."
+	@echo "  make docker      build local image (tenant-registry:dev)"
+
+dev:
+	@APP_ENV=$(APP_ENV) ADDR=$(ADDR) go run ./cmd/server
+
+test:
+	@go test -race ./...
+
+build:
+	@mkdir -p bin
+	@CGO_ENABLED=0 go build -o bin/tenant-registry ./cmd/server
+	@echo "built ./bin/tenant-registry"
+
+fmt:
+	@gofmt -w .
+	@test -z "$$(gofmt -l .)"
+
+vet:
+	@go vet ./...
+
+lint: fmt vet
+
+docker:
+	@docker build -t tenant-registry:dev .
+
+clean:
+	@rm -rf bin