feat(server): tenant-registry skeleton boots against dev stack

Minimal Go service so platform/portal has something to resolve in local
dev. Stdlib net/http with Go 1.22 enhanced ServeMux (method+path
patterns); no third-party deps yet.

Layout:
  cmd/server/main.go               entry point with graceful shutdown
  internal/config/                 env-driven config (APP_ENV, ADDR, KC issuer)
  internal/server/                 http handlers + request-logging middleware
  internal/store/memory.go         in-memory tenant store, seeded with acme
  migrations/0001_init.up.sql      schema for the M4.1 follow-up (unapplied)
  Makefile                         dev/test/build/lint/docker targets
  Dockerfile                       multi-stage distroless build

Endpoints (under :8080 in dev):
  GET /healthz
  GET /v1/tenants/by-slug/{slug}   200 acme | 404
  GET /v1/tenants/{id}             200 by uuid | 404

JWT validation and the real Postgres-backed store land in the M4.1
follow-up PR — keeping this PR strictly to 'boots, replies, tests pass'.

Refs: M4.1 (skeleton)

internal/config/config.go

@@ -0,0 +1,33 @@
+package config
+
+import (
+	"fmt"
+	"os"
+)
+
+type Config struct {
+	Env            string // dev | stage | prod
+	Addr           string // listen address, e.g. ":8080"
+	KeycloakIssuer string // e.g. http://localhost:8080/realms/breakpilot-dev
+	DatabaseURL    string // postgres DSN (unused in skeleton; in-memory store)
+}
+
+func Load() (*Config, error) {
+	env := getenv("APP_ENV", "dev")
+	if env != "dev" && env != "stage" && env != "prod" {
+		return nil, fmt.Errorf("invalid APP_ENV %q", env)
+	}
+	return &Config{
+		Env:            env,
+		Addr:           getenv("ADDR", ":8080"),
+		KeycloakIssuer: getenv("KEYCLOAK_ISSUER", "http://localhost:8080/realms/breakpilot-dev"),
+		DatabaseURL:    os.Getenv("DATABASE_URL"),
+	}, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}