Multi-tenancy: multiple apps and tenants per node #124

docs/compatibility.md: "Tenancy, SSO, audit log, fleet control plane — Not provided by this pre-alpha."

A node serves one app. Running several apps or tenants means running several nodes, each with its own bucket prefix and ingress.

Do

• Decide the isolation model: separate bucket prefixes per tenant, separate object namespaces, and how ingress maps a hostname to a tenant.
• Define what is shared (process, threads, bucket credentials) and what is not.
• Document the security boundary explicitly — this is the part most likely to be got wrong.

Done when

One node can serve more than one app or tenant with a documented isolation boundary and tests for cross-tenant access.