Tenant Config

Schema: { version, updated_at, mode, returns[], tamper_secret|null, enc_pub_jwk|null }