feat(server): add TenantRegistry with per-tenant health tracking

Closes #619. Adds TenantRegistry — a higher-level multi-tenant primitive
that provides JS createTenantRegistry parity for Python deployments.

Adopters pre-build per-tenant DecisioningPlatform instances and register
them; the registry tracks health state (pending/healthy/unverified/disabled)
and surfaces a synchronous resolve_by_host for the hot request path.

Key design choices over the JS surface:
- resolve_by_host is sync (in-memory dict) rather than async — Python owns
  the mapping directly via register()/unregister(), no external resolver.
- auto_validate dropped; validator presence is the opt-in (None = principal-
  token mode, always healthy).
- Per-tenant asyncio.Lock prevents TOCTOU on concurrent recheck() calls.
- unregister()-during-recheck race is guarded: post-validator writes check
  whether the tenant was removed while the validator was awaited.

Exports added to adcp.server: TenantRegistry, TenantResolution,
TenantHealthState, TenantValidator.

Tested with pytest: 25 tests covering lifecycle, state machine, host
normalization, sync/async validators, and concurrency correctness.

https://claude.ai/code/session_019ucMgF6YS9X5bygYUADztx

Author: claude

src/adcp/server/__init__.py

@@ -141,6 +141,12 @@ async def get_products(params, context=None):
     serve,
 )
 from adcp.server.sponsored_intelligence import SponsoredIntelligenceHandler
+from adcp.server.tenant_registry import (
+    TenantHealthState,
+    TenantRegistry,
+    TenantResolution,
+    TenantValidator,
+)
 from adcp.server.tenant_router import (
     CallableSubdomainTenantRouter,
     InMemorySubdomainTenantRouter,
@@ -211,6 +217,11 @@ async def get_products(params, context=None):
     # Idempotency middleware (AdCP #2315 seller side)
     "IdempotencyStore",
     "MemoryBackend",
+    # Multi-tenant registry with health tracking
+    "TenantHealthState",
+    "TenantRegistry",
+    "TenantResolution",
+    "TenantValidator",
     # Subdomain tenant routing
     "CallableSubdomainTenantRouter",
     "InMemorySubdomainTenantRouter",