Enforce user and tenant ownership for persisted state

Parent: #102

Connect authenticated identity to the existing tenant-aware storage model.

Scope:

• Define user, tenant, and membership/role semantics.
• Ensure every conversation, response, and item read/write is constrained by the authenticated principal.
• Prevent ID-based cross-tenant access, including previous-response continuation and conversation creation.
• Add migration/index requirements as needed.
• Add isolation tests for OIDC users and API keys.

Acceptance: a principal cannot read, continue, mutate, or delete another principal's persisted conversation state.

See the parent issue: https://github.com/vllm-project/agentic-api/issues/102

Enterprise Readiness

Enhancement outcome: authenticated users and API keys can safely use shared stateful deployments.

Additional acceptance criteria:

• Derive ownership from verified identity or an explicitly trusted deployment boundary; an arbitrary client tenant header cannot choose the owner.
• Enforce ownership consistently for HTTP and Responses WebSocket continuation, conversation/item operations, compaction, and any persisted tool approval state.
• Scope reusable tool connections and credentials by the applicable security identity; credentials and content must not cross tenants.
• Document how existing unowned rows and single-tenant deployments are handled during rollout; test both supported database backends and concurrent access.

Coordinate with #155 for Conversations operations and #145 for approval records. Existing parent #102 remains relevant.

Enterprise Readiness tracker: https://github.com/vllm-project/agentic-api/issues/316

Start with parent issue #102 and coordinate with #155 for Conversations operations and #145 for approval records. Trace the HTTP and Responses WebSocket persistence paths, then verify isolation tests cover OIDC users and API keys, concurrent access, both supported database backends, and the documented handling of existing unowned rows.