[FEATURE] Helm multitenancy toggle + tenant RBAC (#416 story 5)

[Defilan]

Feature Description

Helm surface for multi-tenancy: a multitenancy.enabled toggle (default off, no-op) that installs the admission webhook and two opinionated tenant RBAC ClusterRoles. Story 5 of #416.

Proposed Solution

• charts/llmkube/values.yaml: multitenancy.enabled: false.
• charts/llmkube/templates/webhook.yaml: the ValidatingWebhookConfiguration, rendered only when enabled.
• charts/llmkube/templates/rbac/tenant-role.yaml (llmkube-tenant: read own-ns Model/InferenceService/UsageReport/TokenBudget; create/update Model + InferenceService) and tenant-admin-role.yaml (superset; manage own-ns GPUQuota, bind TokenBudget). Namespace-scoped via RoleBinding, not ClusterRoleBinding.
• Run make check-helm-rbac (role.yaml union across llmkube + foreman ClusterRoles must stay in sync).

Acceptance Criteria

• helm template with multitenancy.enabled=false renders no webhook and no tenant roles (default is a no-op).
• With =true, webhook + both ClusterRoles render and lint (helm lint, make check-helm-rbac).

Dependencies

• Depends on [FEATURE] GPUQuota validating webhook wiring (#416 story 4) #1095 (webhook must exist).

Note

Review-required, not merge-by-morning. This PR is chart/RBAC YAML with no Go test surface. The coder gate is currently blind to non-Go changes (#1072), so a GATE-PASS here is hollow. Human review before merge.

Priority

• Medium