Tagging and taxonomy module: categorize any record from one vocabulary

Part of #249.

Label and categorize any record: free tags and structured taxonomies, shared across modules so a tag applied to a contact and a tag applied to content live in one vocabulary.

Three unrelated systems that reuse it: a CRM (segment contacts), a media library (organize assets), a survey (categorize questions). Primitive.

Contract:
- A Tag and an optional hierarchical Taxonomy, applied to any record by id and type.
- Query by tag across record types, tenant-scoped.
- No coupling to content: the Files module and a future Contacts module tag through the same surface.

Done when: a module ships with tests (apply, remove, query across types, tenant isolation), an admin screen for managing vocabularies, and a doc showing two different record types sharing a tag.