refactor(clickhouse): bake tenant into parseQueries, drop scopeToTenant

Make tenant scoping unavoidable instead of a step callers must remember to
compose. parseQueries() — the single chokepoint every read/delete WHERE is
built from — now takes the tenant as a required first argument and prepends
the tenant filter itself (shared-tables mode). There is no longer any way to
produce a WHERE clause that isn't tenant-scoped, and PHP/phpstan flag any
caller that omits it.

scopeToTenant() is removed; the tenant is threaded down to parseQueries
through the private read helpers. purge keeps reasoning about the caller's
own (tenant-free) filters for the daily-rollup forwarding decision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: loks0n