[GoDeskio]

This PR is stacked on #25.

• deploy/docker-compose.tenants.yml: runs the proxy and the management API/console (python:3.12-slim with the tools mounted read-only). Both bind to CMO_BIND_ADDRESS (default 127.0.0.1), run read_only as nobody with cap_drop ALL, and wait for the server to be healthy.
• Proxy --watch: listeners follow tenants.json within about 2 s. New, changed and removed databases need no restart. Open connections keep their old limits until they reconnect. 1 new test.
• Fix: the server regenerates its ACL file on every restart, which would have wiped database users. The management API now keeps only a SHA-256 of each password (ACL '#hash' form) and re-applies users every 30 s. The plaintext is still shown once and never stored. 1 new test.
• Env example: documents CMO_ADMIN_TOKEN, CMO_MGMT_PORT and CMO_TENANT_PORTS.
• CI: docs/ci/cmo-tenants-test.patch.
• Not run: Docker isn't on the box, so the overlay has not been started with docker compose; only its YAML was parsed.