feat: tenant isolation for single-instance multi-tenant deployment

[Copilot]

A single deployed backend instance needs to serve users within a company under an isolated tenant scope, with tenant derived automatically — no manual configuration required.

Approach

Tenant resolution (TenantService):

• No auth → hardcoded tenant "global"
• OIDC enabled → last path segment of JWT issuer URL (Keycloak: http://host/realms/compas → "compas")
• Handles trailing slashes, bare hostnames, null/blank issuer, and missing tokens — all fall back to "global"

// OIDC: http://keycloak/realms/my-company  →  "my-company"
// No auth / fallback                        →  "global"
String tenant = tenantService.resolveTenant();

Database (V1_8 Flyway migration):

• Adds tenant varchar(255) NOT NULL DEFAULT 'global' + index to scl_file
• Existing rows migrate safely to "global" tenant

Layer changes — tenant threaded as first parameter through every read/write path:

• CompasSclDataRepository interface + PostgreSQL implementation (all SQL queries filter/insert by tenant)
• SoftDeleteCompasSclDataPostgreSQLRepository (DELETE SQL updated)
• CompasSclDataService — all public methods
• CompasSclDataResource + CompasPluginsResource — inject TenantService, resolve per request
• WebSocket event models (CreateEventRequest, GetEventRequest, GetVersionEventRequest, UpdateEventRequest) + all 4 endpoints + CompasSclDataEventHandler
• CompasPluginsResourceService (list, count, upload)

scl_label is unaffected — tenant isolation is enforced via the scl_file FK, no column needed there.