Prefer tenant-2 services on separate hosts

[artemnikitin]

Summary

• assign tenant-2 Kibana and Elasticsearch to the same anti-affinity group
• prefer the pair on different Firework hosts when multiple nodes have capacity
• leave tenant-1 placement unchanged so its existing colocated case remains valid

Closes #27.

Placement semantics

Firework anti-affinity is a preference: tenant-2 will still colocate when no alternative node has capacity. Firework currently has no positive-affinity field, so this change does not add a hard tenant-1 colocation constraint.

Validation

• go run ./cmd/configcheck --require-remote-routing --input-dir /Users/artemnikitin/git/firework-gitops-example
• git diff --check