Tenancy: a Single or Multi mode that refuses the default partition and unregistered slugs in Multi

`barakoCMS/Infrastructure/Auth/TokenIssuer.cs:102-103` issues a token for the default tenant with no membership check, and `:105-118` does the same for any slug that has no Tenant document. Both are right for a single-site deployment, where nobody ever creates a tenant. On a multi-client deployment the same rules mean any user can get a token for the default partition, and for any unregistered slug a subdomain happens to produce. `docs/tenancy-at-the-database.md:17-20` says Postgres cannot tell "no tenant" from "the default tenant", so database enforcement does not close it either.

### Why it matters

An agency hosting a clinic and a school on one API cannot say "every request belongs to a registered client". A mistyped subdomain lands in a partition nobody owns, and whatever sits in the default partition (seed data, a demo, an old single-site install that grew into multi-tenancy) is reachable by any account.

### The general concept

A deployment mode, `Tenancy:Mode`, Single or Multi. Single keeps today's behaviour exactly. Multi refuses the default partition for content and authoring, and refuses any slug without a Tenant document, at resolution and at token issue, so the two exemptions become a statement about the deployment rather than a guess per request.

### Where it lives

Core: multitenancy and auth.

### Compatibility

Released. Default is Single, which preserves every existing deployment. Multi is opt-in, so no stored data changes and the HTTP contract does not change for anyone who does not turn it on.

### Done when

- With Mode Multi, a token request for the default tenant or an unregistered slug is refused, and a test showing that fails before the change.
- With Mode Multi, a request resolving to an unregistered slug by subdomain gets 404.
- With no setting, the existing single-tenant and playground tests pass unchanged.

Found in the architecture sweep of 15 September 2026.

Start with barakoCMS/Infrastructure/Auth/TokenIssuer.cs:102-118 and read the tenancy resolution path for subdomain slugs. Review docs/tenancy-at-the-database.md:17-20, then add failing tests for Multi mode token refusal and unregistered-slug 404 resolution. Done means Multi rejects the default and unknown tenants while the no-setting single-tenant and playground tests remain unchanged.

Written by the indexing model from the issue text.