feat: add tenant-scoped config snapshots and recipe activation

Summary

Add tenant-scoped config snapshot, validation, activation, and rollback semantics for shared-router multi-tenancy.

Parent roadmap: #2287 Parent issue: #2342 Depends on: #2326, #2331 Related code: src/semantic-router/pkg/config, dashboard/backend/handlers/config.go, dashboard/backend/configprojection, deploy/operator

Motivation

Versioned config snapshots are necessary but not sufficient for multi-tenancy. Each tenant needs isolated routing/recipe activation while sharing global system resources where allowed. This issue defines the config-control-plane semantics for that split.

Scope

Define and implement:

• shared base config plus tenant overrides;
• tenant-scoped validation/diff/activate/rollback;
• per-tenant entrypoint/recipe mapping;
• config dump/status that can show tenant scope safely;
• dashboard/operator handling for tenant config operations.

Non-goals

• Do not duplicate global model assets per tenant by default.
• Do not let one tenant activate config for another tenant.
• Do not bypass #2326 snapshot semantics.

Acceptance criteria

• Tenant configs can be validated and activated independently.
• Shared global resources and per-tenant routing profiles are separated in config.
• Rollback and diagnostics operate at tenant scope.