Wire tenant_roles as explicit opt-in configuration

Closes gap G07. The tenant-engine client and TokenHandler.TenantEngine were
implemented and tested, but main.go supplied no client and exposed no
configuration, so the stock executable left the field nil and the capability
existed at library level only.

A tenantEngine block with baseURL and an optional timeout now wires it. An empty
baseURL leaves the stock server's behaviour exactly as it was, so enabling the
claim is a deliberate act. Validation treats a configured source as one that must
work: http/https with a host, and a timeout in (0, 10s] since it sits on the
synchronous token-issuance path. A timeout set without a baseURL is rejected
rather than ignored -- it means someone expected the claim to be on.

Verified in the built executable, which is what G07 asks for, rather than at the
wiring: against a stub source a real token carries tenant_roles; with no block
the claim is absent; with the source configured but down, issuance succeeds
without it, confirming the documented fail-open path end to end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

SCOPE.md

@@ -35,9 +35,11 @@ Keycloak interchangeability are not established.
   session store, general refresh-token flow, token introspection/revocation API,
   or automatic signing-key/client-secret rotation service. Logout clears the
   local KeyCape session, not every upstream or downstream session/token.
-- The optional tenant-engine `tenant_roles` adapter and handler support exist,
-  but the server entry point does not configure them. That claim is not an
-  enabled capability of the stock executable.
+- The optional tenant-engine `tenant_roles` adapter is wired through a
+  `tenantEngine` config block and is off unless `baseURL` is set (KEY-WP-0024).
+  When enabled it fails open: an unreachable source omits the claim rather than
+  failing issuance, so `tenant_roles` is a cache and must not be trusted for
+  privileged decisions.
 - The LLDAP export enumerates the group subtree directly, so groups with no
   members are present, and every snapshot carries a `groupEnumeration` field
   saying whether that enumeration ran or the membership-derived fallback did