Introduces a tenant dimension to every GraphRAG in-memory store and the
query surface, so every ingest and query lands in the calling tenant's
slice of the graph.

Architecture
- New tenantStores composite bundles one tenant's ServiceStore,
  TraceStore, SignalStore, AnomalyStore. GraphRAG drops the four
  direct-store fields and instead holds tenants map[string]*tenantStores
  guarded by its own RWMutex; slices are lazy-created via
  storesFor(ctx) / storesForTenant(tenant). The default tenant is
  seeded at New() so background loops have a baseline to iterate.
- spanEvent / logEvent / metricEvent each carry Tenant string;
  OnSpanIngested / OnLogIngested / OnMetricIngested derive it from
  storage.Span / storage.Log / tsdb.RawMetric TenantID fields. Callback
  signatures are intentionally unchanged — tsdb.RawMetric already
  carries TenantID from ingest/otlp.go, so no second argument or struct
  change is needed for the metric path.
- Every public query method takes ctx as its first argument and routes
  through storesFor(ctx): ErrorChain, ImpactAnalysis, RootCauseAnalysis,
  DependencyChain, CorrelatedSignals, ShortestPath, AnomalyTimeline,
  ServiceMap, SimilarErrors. Two narrow helpers (AllServiceEdges,
  AnomaliesForService) let handlers read store data without reaching
  into the composite directly.
- Background loops (refresh, snapshot, anomaly) iterate a stable
  snapshot of tenants on each tick, wrap ctx with
  storage.WithTenantContext(ctx, tenant), and act on each slice under
  its own per-store lock. rebuildAllTenantsFromDB enumerates tenants
  from the spans table so historical data from tenants without live
  callbacks is still recovered.
- The Drain log-template miner stays shared across tenants — templates
  describe log shape, not content — while per-tenant SignalStore maps
  keep cluster nodes isolated. Persisted tables (investigations,
  graph_snapshots, drain_templates) intentionally unchanged; Subtask B
  (RAN-38) owns the tenant_id column migration. PersistInvestigation
  now accepts tenant as its first arg so the column can be wired in B
  without a signature break.

External callers updated
- internal/mcp/tools.go: all GraphRAG-backed tools take ctx and thread
  it through the query call; AnomalyStore direct access replaced with
  AnomaliesForService.
- internal/api/graph_handler.go: handleGetSystemGraph uses
  r.Context() throughout, the 10s response cache is tenant-keyed so
  cross-tenant cache hits are impossible, and ServiceStore direct
  access replaced with AllServiceEdges.

Tests
- builder_test + investigation_cooldown_test updated to new signatures.
- New tenant_isolation_test covers the core RAN-37 invariant: two
  tenants ingesting overlapping data see only their own services /
  traces, and empty-context lookups collapse to DefaultTenantID.
- go build ./... && go vet ./... && go test ./... all green;
  go test -race ./internal/graphrag/... clean.

Scope
- Out of scope: persisted-table tenant columns (Subtask B, RAN-38),
  MCP-level tenant-isolation integration test (Subtask C, RAN-39 —
  the merge gate for RAN-19). internal/graph/ legacy package untouched.

Refs RAN-19 RAN-21

Co-Authored-By: Paperclip <noreply@paperclip.ing>

The PR-27 build failed CI because internal/graphrag/clustering.go and
internal/mcp/tools.go both called the 3-arg vectordb.Index.Search(tenant,
query, k) signature, but that signature lives on RAN-20's vectordb
tenant-isolation work and is not yet on main. The 3-arg form leaked in
from a stacked branch during the original RAN-37 cut.

Restore the 2-arg Search(query, k) call in both sites and leave a
TODO(RAN-20) so the proper vector-side tenant scoping lands with the
RAN-20 follow-up. RAN-37's in-memory tenant invariants are unaffected:
SimilarErrors still narrows results by the per-tenant SignalStore's
EMITTED_BY edges, so cross-tenant hits cannot surface even while the
underlying vector index is shared.

go build / vet / test ./... and -race on graphrag + api all green.

Co-Authored-By: Paperclip <noreply@paperclip.ing>