Issue #3593858: document multi-tenancy

Add a Multi-tenancy guide page (concept and isolation model, managing tenants, per-tenant Master KEK, consumer binding, shared vs tenant-scoped kinds, per-tenant rotation, custom tenant resolvers) and wire it into the nav. Correct the roadmap (multi-tenancy is in place, not planned; only the domain-based connector remains) and the installation rotation docs (per-tenant). Add tenant-scope notes to the item-kinds, client-server, and cross-site API pages.

Closes #3593858