[Epic]: Data residency selection and enforcement

## Summary
Add data residency selection and enforcement — region-pinned inference routing plus a documented, defensible data boundary — directly answering EU AI Act deployer-obligation and GDPR questions now appearing as named RFP line items.

## Intent / Source of truth
GitHub ships a US + EU data boundary; Windsurf ships region selection with zero-data-retention defaults. As a self-hosted platform proxying some SaaS models, we will be scrutinized harder than a pure-SaaS vendor on exactly where inference happens — region-pinned routing plus a documented, defensible boundary is the answer. Source: 2026-08-13 enterprise-readiness research pass.

## Scope
- [ ] Region-pinned routing for inference requests (self-hosted fleet and, where the upstream provider supports it, SaaS-proxied models)
- [ ] Documented data boundary (which regions data can/cannot leave) with an explicit, defensible statement of where each supported model actually executes
- [ ] Customer-facing region-selection controls

## Out of scope
- Standing up new regional infrastructure beyond what's needed to prove the boundary claim (infra scaling is a separate, follow-on decision once a customer commits)

## Verification
A request routed under an EU-pinned policy is provably served only by EU-region infrastructure (self-hosted) or an EU-region SaaS endpoint (where the upstream vendor offers one); the documented boundary accurately reflects every route, verified against the live gateway config.

## Risk assessment
For SaaS-proxied models, the actual data boundary is bounded by what the upstream provider offers — the documentation must be honest about which models can and cannot be region-pinned, not overstate residency guarantees the platform can't actually enforce end-to-end.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.