feat: add namespace-isolated multi-tenancy

[vicotrbb]

Summary

• add opt-in namespace-per-tenant isolation while preserving the existing single-operator behavior when tenancy is disabled
• add Helm-managed tenant namespaces, scoped RBAC, tokenless workspace service accounts, ResourceQuota, and default-deny workspace ingress policies
• add Secret-backed principals with viewer/member/admin roles, tenant-aware sessions and CLI credentials, credential-rotation revocation, and enumeration-safe authorization failures
• add per-tenant presets, storage, TTL, GPU defaults/allowlists, custom image allowlists, workspace Secrets, and service accounts
• add X-Devboxes-Tenant, --tenant, DEVBOX_TENANT, saved tenant selection, tenant list/use, and a role-aware dashboard tenant switcher
• scope workspace ownership, lifecycle reconciliation, Insights ingestion/query/purge, and SQLite exports by tenant; support the same workspace name safely in different namespaces

Security and compatibility

• use namespace-scoped Roles and RoleBindings; the controller receives no ClusterRole
• mount principal tokens read-only from an existing Secret with restrictive permissions
• validate tenant namespaces, labels, GPU/image policy, storage, quotas, and Secret/service-account names at both Helm schema and controller startup boundaries
• use managed-resource ownership checks and Kubernetes resourceVersion preconditions around lifecycle races
• preserve legacy unlabeled workspaces and v1 Insights credentials by adopting them into the configured default tenant only when tenancy is enabled
• keep tenancy fully disabled by default, with no tenant labels/selectors or credential-format changes in legacy mode
• document NetworkPolicy CNI enforcement requirements and ResourceQuota admission/degraded-rollout behavior explicitly

Documentation

Updates the README, security model, architecture, API, CLI, credentials, configuration, operations, troubleshooting, GPU/image/Insights guides, Golden Path, component READMEs, chart notes, changelog, and contribution guidance. Adds a dedicated multi-tenancy operations and threat-model guide plus product design principles.

Validation

• make lint
• make test — 179 controller tests, 87.56% coverage; 28 CLI tests
• make helm — Insights, GPU, custom-image, and tenancy Helm contracts
• DEVBOXES_E2E_CLI=cli/target/debug/devbox scripts/kind-e2e.sh — fresh Kind install, legacy upgrade/adoption, scoped RBAC, same-name isolation, role enforcement, CLI selection, tenant-scoped telemetry, sanitized SQLite export, SSH/PVC lifecycle, and cleanup
• live dashboard QA at desktop and 390x844 mobile widths, including tenant switching, query persistence, role-aware controls, tenant-specific presets/GPU/images/docs, and zero horizontal document overflow

Closes #33