Multi tenant approach - cleanup done

cygnus-cloud-service/README.md

@@ -53,10 +53,10 @@ on-premises gateway. The client assertion must be:
 - bound to the configured client ID, installation ID, and token audience;
 - unexpired and no longer-lived than `CYGNUS_ASSERTION_TTL`.
 
-The endpoint returns a short-lived RS256 access token carrying `client_id`,
-`installation_id`, and the approved scope. The identity endpoint requires the
-`identity.login` scope and verifies the same machine binding in the encrypted
-login payload.
+The endpoint returns a short-lived RS256 access token carrying the client,
+installation, tenant, license, security-version, and approved-scope claims.
+The identity endpoint requires the `identity.login` scope and verifies the
+same machine and tenant binding in the encrypted login payload.
 
 Generate separate cloud key pairs:
 
@@ -73,26 +73,28 @@ openssl pkey -in config/keys/access-token-private.pem -pubout \
 chmod 600 config/keys/*private.pem
 ```
 
-Configure clients in an external Spring YAML file rather than the packaged
-`application.yml`:
+## Dynamic tenant, installation, and license registration
 
-```yaml
-cygnus:
-  security:
-    enabled: true
-    issuer-uri: https://cloud.example.com
-    audience: cygnus-cloud-api
-    token-audience: https://cloud.example.com/oauth2/token
-    clients:
-      customer-a:
-        enabled: true
-        installation-id: site-01
-        assertion-public-key: file:/secure/clients/customer-a/public.pem
-        scopes:
-          - identity.login
-```
+Machine clients are no longer configured in a runtime `clients.yml`. The
+authoritative records are:
 
-Start with that protected file using
-`--spring.config.additional-location=file:/secure/cygnus/clients.yml`.
-Never place cloud private keys, customer assertions, or installation private
-keys in the repository or container image.
+- `identity.client_account`: tenant identity and status;
+- `identity.client_installation`: machine identity, assertion public key,
+  allowed scopes, enabled state, and security version;
+- `identity.client_license`: subscription period, package, type, status, and
+  licensed limits.
+
+Token issuance resolves the installation and active license through a
+Redis cache-aside service with PostgreSQL fallback. Cache entries have a
+bounded TTL and can be invalidated after administrative changes. Therefore,
+new customers, installations, key rotations, scope changes, and license
+changes do not require restarting the cloud service.
+
+The login/menu queries are tenant-scoped. Tenant-owned identity tables carry
+`tenant_id`; `identity.pages` remains the shared feature catalog while
+permissions are assigned per tenant.
+
+Use `scripts/setup-local-communication.sh` to create keys, register or update
+the database records, create the initial license, and generate the on-premises
+machine assertion. Never place cloud private keys, customer assertions, or
+installation private keys in the repository or container image.