revert(app-studio): restore /clusters/<path> tenant addressing (#358)

PR #357's bare-path change routed tenant traffic to the user's
DefaultCluster, which is NOT the selected workspace when the user is in
any non-default workspace — silently reading/writing the wrong
workspace's projects instead of erroring. Restore the original
/clusters/<tenantPath> addressing (an honest 403 from the hub proxy)
until the GraphQL migration lands proper per-workspace access.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mjudeikis

providers/app-studio/tenant/client.go

@@ -16,11 +16,7 @@ You may obtain a copy of the License at
 // The base kubeconfig (the provider's own kcp connection) supplies only the
 // front-proxy host + TLS; its credential is dropped so the factory can never
 // authenticate as the provider. Per request we build a config with that host
-// (no /clusters/ segment) and the caller's bearer token: the kedge hub proxy
-// scopes bare paths to the caller's own DefaultCluster, which is the only
-// workspace this factory ever talks to. Addressing by the tenant's workspace
-// *path* instead would be rejected — the proxy's cluster gate accepts only the
-// caller's DefaultCluster *ID* (or ID:mount), not a path.
+// (cluster segment swapped for the tenant's path) and the caller's bearer token.
 package tenant
 
 import (
@@ -74,14 +70,8 @@ func NewClientFactory(base *rest.Config) *ClientFactory {
 	}
 }
 
-// For returns a dynamic client scoped to the caller's own workspace,
-// authenticating as the caller via token. Cached per (tenant, token).
-//
-// The host carries no /clusters/ segment: the hub proxy scopes bare paths to
-// the token's DefaultCluster. tenantPath is retained only as a cache key — the
-// caller always acts within its own default workspace, so a request must never
-// be addressed by the workspace path (the proxy's gate rejects paths, accepting
-// only the DefaultCluster ID).
+// For returns a dynamic client scoped to tenantPath, authenticating as the
+// caller via token. Cached per (tenant, token).
 func (f *ClientFactory) For(tenantPath, token string) (dynamic.Interface, error) {
 	if token == "" {
 		return nil, fmt.Errorf("no bearer token on request — cannot act on the tenant's behalf")
@@ -93,7 +83,7 @@ func (f *ClientFactory) For(tenantPath, token string) (dynamic.Interface, error)
 	}
 
 	cfg := &rest.Config{
-		Host:            f.baseHost,
+		Host:            f.baseHost + "/clusters/" + tenantPath,
 		BearerToken:     token,
 		TLSClientConfig: f.baseTLS,
 	}