docs: add shared app tenant routing architecture

[onutc]

Summary

• add a Spritz-side architecture doc for routing one shared Slack, Discord, or Teams app to per-tenant instances
• define tenant binding as the missing native concept, while reusing existing owner, preset, instance class, and extension concepts
• describe the install flow, inbound routing flow, and follow-up API direction

Validation

• npx -y @simpledoc/simpledoc check docs/2026-03-23-shared-app-tenant-routing-architecture.md

[onutc]

Final report

Status: ready from the changes in this PR. Latest local Codex review against main reported no P0/P1 findings. Latest GitHub checks on head 808329e are green.

Validation run:

• gofmt -w api/channel_routes.go api/channel_routes_test.go api/internal_spritzes.go api/internal_spritzes_test.go
• cd api && go test ./... -> passed
• codex review --base main -> no P0/P1 findings on the latest head

What was verified:

• channel route resolver requests now use the effective namespace rules for the current server mode
• resolver results reject cross-namespace mismatches in namespace-scoped deployments
• internal spritz summaries redact externally resolved owner ids

What was not tested locally:

• live resolver behavior against a real external channel.route.resolve implementation
• live internal-auth calls from backend to Spritz in staging/production

Recommended follow-up verification outside local:

• staging end-to-end channel route resolve with a real external registry
• internal GET /api/internal/v1/spritzes/:namespace/:name from a real shared gateway/backend caller