Multi tenancy implementation

[GokulVGAot]

Description

Adds header-based multi-tenancy and a runtime in-memory connector config API while keeping the existing single-tenant YAML flow working.

Core

• Trusted tenant identity from X-Tenant-ID / NW_TENANT_ID_HEADER (optional env pin, JWT tenant_id fallback, else __default__)
• ConnectorConfigStore with named configs per (tenant, connector), default selection, redacted reads, and fail-closed lookups
• YAML bootstrap into __default__ on startup (NW_CONFIG_BOOTSTRAP_YAML)
• Async factory get(tenant_id, config_name) with a three-part cache key, invalidation on writes, config injection on BaseConnector, and tenant-scoped secrets (NW_{TENANT}_{CONNECTOR}_{KEY})

Bindings

• REST: /v1/... config CRUD; invoke uses header tenant + optional config_name; tenant prepended to the REST rate-limit key
• gRPC: optional config_name on InvokeRequest; tenant from metadata
• MCP: session/header/NW_TENANT_ID tenant pin; optional config_name tool argument

Playground

• Tenancy bar (Tenant ID + Config name) on connector runs
• Google Drive runtime config CRUD panel wired to the shared REST store for manual fail-closed → provision → invoke testing

Tests

• New tests/test_multitenancy.py covering store lifecycle, identity, factory isolation/invalidation, fail-closed 403s, and direct integration
• Existing REST/MCP tests updated for the async tenant-aware path

Intentionally deferred: gRPC streaming and store.export().

Related Issue

Type of Change

• Bug fix
• New feature
• Documentation
• Refactor / chore

Checklist

• I ran the quality checks locally (ruff, mypy, bandit, pytest).
• New files include the required SPDX/REUSE license header.
• I added or updated tests where appropriate.
• I updated documentation where appropriate.
• My commits use a correctly configured git identity (real name and email).
• All my commits are signed off (git commit -s) per the DCO.