Replace the bucket-per-tenant model with one muxed bucket (config.bucket),
keyed "<tenant>.<key...>". The Rego interface is unchanged: data still lands at
data.nats.kv.<tenant>.<...> and the builtins (nats.kv.watch_bucket /
nats.kv.get_data) keep their names and arity — their first argument is now the
tenant token (the leading key segment) instead of a bucket name.

Core changes:
- config: add required `bucket`; rename `root_bucket` -> `root_tenant`
  (a tenant whose subtree mounts at the OPA data root).
- NATSKeyToOPAPath: derive the tenant from the key's first token (drop the
  out-of-band bucket arg); root mode strips the tenant token.
- nats_client: open the single bucket once (cached); add tenantKeys(), a
  prefix-filtered lister so loads are O(tenant), never O(whole bucket).
- watcher: watch "<tenant>.>" (single filter -> scopeable consumer) instead of
  ">"; identity is the tenant.
- builtins: loadTenantAsGJSON reads only the tenant slice and strips the
  "<tenant>." prefix via the new pure buildTenantJSON helper.

Tests (TDD for the pure logic):
- reshaped path-mapping/config/JSON-builder unit tests;
- new muxed_integration_test.go (real NATS): tenantKeys isolation, data
  placement, root-tenant stripping;
- migrated the example (one DATA bucket, <tenant>.* keys) + configs; the
  docker-compose integration test passes end to end.

No backward compatibility retained (intentional).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…le bucket to POLICY_DATA

The muxed bucket name is required configuration for the reader — there must be no
implicit default that could silently point at the wrong bucket. Remove the
"DATA" default from DefaultConfig (Validate still enforces "bucket is required")
and set the example/deployment bucket to POLICY_DATA to match the data-generator
producer (NATS_KV_BUCKET=POLICY_DATA).

- config: DefaultConfig no longer sets Bucket (mandatory, explicit-only).
- example configs + docker-compose seeding + account perms: DATA -> POLICY_DATA.
- README: document `bucket` as required; fix the stale root_bucket -> root_tenant row.
- tests: set Bucket explicitly where DefaultConfig is validated; assert no default.

Verified: pkg suite + cmd docker-compose integration green; golangci-lint 0 issues.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- tenantKeys now takes a context.Context, binds the watch with nats.Context(ctx),
  selects on ctx.Done(), and treats a watch channel that closes BEFORE the nil
  initial-values marker as an error instead of silently returning a truncated key
  set (partial tenant data can flip an authz decision). ctx is threaded through
  loadTenantAsGJSON / LoadBucketDataBulk / the builtins.
- buildTenantJSON: a failed Get now returns nil and is SKIPPED (not written as an
  explicit null); the sjson error is handled; non-JSON stored values fall back to
  a JSON string, mirroring loadSingleKey so the read and bulk-load paths agree.
- NATSClient drops the cached bucket handle on reconnect so it is re-opened lazily.
- validateTenant rejects tenant ids that aren't a single safe NATS subject token
  (empty / '.' / '*' / '>' / whitespace) at tenantKeys and the watcher Start, so
  the subject-token watch and the string-prefix read paths cannot diverge.
- Removed the dead DataTransformer.rootBucket field and the now-unused config
  param from NewDataTransformer.
- Gated muxed_integration_test.go behind //go:build integration; switched the
  connect-dependent plugin tests to require.* so they fail cleanly instead of
  nil-deref-panicking when NATS is unreachable.

Addresses review comments:
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)
- #4 (comment) (@zeevmoney)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… instead of failing open

watch_bucket special-cased nats.ErrBucketNotFound and returned false. With the
single muxed bucket an absent tenant yields zero keys (handled separately by
loadTenantAsGJSON returning a Null result, no error), so ErrBucketNotFound here
can only mean the configured bucket is missing — a deployment misconfiguration.
Returning false silently evaluates policy against missing data; surface the
error instead, consistent with get_data. Removed the now-unused errors/nats
imports.

Addresses review comments:
- #4 (comment) (@zeevmoney)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>