feat: scope services and usage by tenant

[Muyutxd1]

Closes #39

/claim #39

Summary

• add a request tenant resolver that derives tenant scope from a recognized X-API-Key and falls back to the legacy public tenant when no valid key is present
• scope service registration, reads, metadata, disabled state, price/delete mutations, usage accumulation, exports, billing, settlement, and service/agent rollups by tenant
• keep cross-tenant service access as 404 not_found and add regression tests for same-service-id isolation, mutation isolation, settlement isolation, and public-tenant fallback
• document the multi-tenant behavior and internal API-key hashing

Tests

pm run build

pm test (93 tests passed; on Windows run with
pm_config_script_shell pointed at Git Bash so the existing POSIX NODE_ENV=test script executes as written)

pm run lint

Isolation notes

• Store keys keep the existing public-tenant shape for backwards compatibility, while recognized API-key tenants use hashed internal tenant ids.
• Cross-tenant reads and mutations intentionally return 404 not_found so service ids cannot be enumerated across tenants.