Managed hosting: preserve tenant-ready architecture

[TristanEDU]

Goal

Keep managed hosting possible without making it the first private-alpha launch.

Scope

• Maintain tenant/vault/installation identifiers in core types and storage.
• Keep server APIs compatible with multiple vaults per tenant.
• Track install state separately from vault state.
• Keep self-hosting as the first supported deployment path.

Done when

• Managed-hosting assumptions are documented.
• Schema changes do not block later managed-hosting work.
• Self-host docs remain the primary launch path.