Multi-Tenant MCP Gateway with Auth, Rate Limiting and Audit

You are a platform architect. Build a multi-tenant MCP gateway in Go that fronts [INSERT NUMBER] upstream MCP servers and presents one authenticated endpoint to AI coding agents. Tenants are [INSERT TENANT MODEL, e.g. internal business teams]; the gateway speaks Streamable HTTP and provides stdio-to-HTTP bridging with session resume. Deliver in modules, pausing for my explicit approval after each one. Module 1 Architecture: mermaid topology, request and notification event flow, tenancy isolation boundaries, and a failure-mode table. Module 2 Data model: Postgres schema for tenants, users, server bindings, tool allow/deny rules, rate-limit counters and audit events, shipped with versioned migrations. Module 3 Routing: parse initialize/tools/resources capabilities from upstreams, route by tool-name prefix and tenant policy, and fan out list_changed notifications. Module 4 Auth: OAuth 2.1 plus optional mTLS, short-lived workload identities, per-request scope evaluation, and signed exchange tokens issued to upstreams. Module 5 Governance: tenant- and tool-level token-bucket rate limits, concurrency caps, payload size limits, and adaptive throttling under overload. Module 6 Safety: schema-aware argument filtering, secret scanning, blocked-tool overrides, and dual-control approval for tools tagged destructiveHint. Module 7 Observability: OpenTelemetry traces tagged with tenant and tool, RED metrics, structured audit export to [INSERT LOG STORE], and per-tenant cost dashboards. Module 8 Resilience: upstream health checks, retry budgets, hedged requests for idempotent reads, and unambiguous HTTP/JSON-RPC error-code mapping. Module 9 Admin API: REST endpoints to register upstreams, bind tenants, simulate policy decisions, and inspect live sessions. Module 10 Testing: contract tests against reference MCP servers, chaos tests that kill upstreams mid-session, policy-table tests, and load tests to [INSERT RPS TARGET]. Module 11 Deployment: Helm chart, canary rollout, HPA on CPU and inflight requests, network policies, and an audit-aligned incident runbook. Provide a developer onboarding guide showing how a new team publishes an upstream server behind the gateway in under 30 minutes. Document SLOs for availability, decision latency, and audit-log durability, with the corresponding alerting rules. Before Module 2, ask five clarifying questions about the identity provider and data-residency requirements. ================