Add tenant isolation section to Fleets and Exports docs

Describe the current host access model for fleet workloads and link
to the SSH reverse proxy roadmap issue. Add a brief cross-reference
in the Exports page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Andrey Cheptsov

docs/docs/concepts/exports.md

@@ -134,6 +134,9 @@ $ dstack fleet list
 
 Imported fleets can be used for runs just like the project's own fleets.
 
+!!! info "Tenant isolation"
+    Exported fleets share the same access model as regular fleets. See [Tenant isolation](fleets.md#tenant-isolation) for details.
+
 !!! info "What's next?"
     1. Check the [`dstack export` CLI reference](../reference/cli/dstack/export.md)
     2. Learn how to manage [fleets](fleets.md)

docs/docs/concepts/fleets.md

@@ -468,6 +468,15 @@ ssh_config:
 !!! info "Reference"
     The fleet configuration file supports additional options, including [`instance_types`](../reference/dstack.yml/fleet.md#instance_types), [`max_price`](../reference/dstack.yml/fleet.md#max_price), [`regions`](../reference/dstack.yml/fleet.md#max_price), among others. For the complete list, see the [reference](../reference/dstack.yml/fleet.md).
 
+## Tenant isolation
+
+Workloads running on a fleet have access to the host, including mounted folders. For distributed workloads,
+containers use host network mode.
+
+Tighter isolation is on the roadmap, including [SSH reverse proxy](https://github.com/dstackai/dstack/issues/3644){:target="_blank"} and rootless access to the host.
+
+When [exporting fleets](exports.md) to other projects, the same access model applies to members of the importer projects.
+
 ## Export fleets
 
 Fleets can be exported to other projects, allowing those projects to use the exported fleets