Tenant identification via header extraction

[shaneutt]

Extract tenant identity from request headers and inject into FilterContext for downstream filters.

Requirements

• Extract tenant ID from configurable header (default: X-Tenant-ID)
• Inject tenant identity into FilterContext metadata
• Optional: reject requests without tenant header (configurable)
• Optional: validate tenant ID against allowlist
• Support tenant ID from JWT claims (via claims extraction filter)

Implementation Notes

• Lightweight filter that runs early in the pipeline
• Tenant identity available to rate limiting, routing, logging, and metrics filters

Parent epic: #301