feat: multi tenant queries

[masonlet]

Multi-tenant queries

Lets one deployment serve charts for multiple consumers via ?source=, while keeping personal deployments unchanged.

Modes (mutually exclusive)

• Personal GITHUB_USERNAMES/GITHUB_ORGS: the users own chart, exactly as before. ?source= is rejected.
• Hosted (enumerated) GITHUB_ALLOWED_SOURCES=masonlet,gh-top-languages: bare URL renders the combined chart; ?source= selects a subset.
• Hosted (open) GITHUB_ALLOWED_SOURCES=*: any GitHub account, ?source= required, max 10 names per request.

Hosted modes fetch via /users/{name}/repos and never carry per-source tokens, so they are public-repos-only.

Architecture

• Cache rewritten from one global blob to a per-source Map keyed kind:name, merged at read time. One source failing no longer poisons the aggregate: it falls back to its own stale entry with per-entry backoff.
• In-flight fetches are coalesced and strictness-neutral, callers share one fetch but each get their own error semantics.
• Unknown accounts are negative-cached for 10 min; request-shaped errors get Cache-Control: public, max-age=300, server/config errors stay no-store.
• Names are deduped case-insensitively everywhere they enter (URL, env config, allowlist).

Referer gate (preview-only deployments)

Optional ALLOWED_REFERERS restricts rendering to requests whose Origin/Referer hostname matches; for a deployment that only serves a builder site's live previews.