Sync GovOPlaN module state

docs/TENANCY_MODULE_BOUNDARY.md

@@ -0,0 +1,29 @@
+# GovOPlaN Tenancy Module Boundary
+
+`govoplan-tenancy` owns tenant registry, tenant settings, tenant lifecycle, and
+tenant-context route contributions.
+
+## Owned Routes
+
+- `/api/v1/admin/tenants*`: tenant registry, delta feed, owner candidates,
+  settings, deletion plans, retirement, and guarded empty-tenant destruction.
+- `/api/v1/tenancy/switch-tenant`: tenant-owned route surface for interactive
+  tenant context switching.
+
+`/api/v1/auth/switch-tenant` remains in `govoplan-access` for API
+compatibility, but both routes delegate to the same
+`auth.tenantContextSwitcher` capability.
+
+## Lifecycle Rules
+
+Tenant retirement is non-destructive. It marks the tenant inactive and stores
+lifecycle metadata in tenant settings.
+
+Destructive deletion is intentionally narrow: it is allowed only when the
+tenant is not the caller's active tenant and all registered tenant-owned counts
+are zero. Populated tenants must be retired first or cleaned explicitly by
+their owning modules before physical deletion.
+
+Tenant lifecycle planning uses registered tenant summary providers and delete
+veto providers. Modules that own tenant-scoped data must contribute summaries
+so destructive deletion cannot silently miss their rows.