Document what happens to a durable listener when one tenant's database is down #4660

There are no docs for what a Wolverine application does when one tenant's database is unreachable while a durable listener is serving every tenant from the same endpoint. The behaviour has been designed and fixed twice now and is entirely undocumented — a repo-wide grep finds no reference to #4438 in docs/, and the multi-tenancy and durability pages do not cover it.

This is the behaviour worth writing down, all of it current on main after #4658:

• A failure writing to a tenant database is tenant-scoped (TenantedInboxWriteException with IncludesMainStore: false). Those envelopes are deferred back to the broker and the listener keeps running for every other tenant.
• A failure that reached the main store pauses the listener for inbox recovery, because nothing can be persisted at all.
• That pause is indefinite. Nothing resumes a listener except InboxHealthRestarter's probe, which retries on a 2s → ×1.5 → 30s back-off, forever. Worth saying plainly, because "paused" reads as temporary.
• The probe tests the main store only (A tenant-only inbox failure in a single-store batch pauses the listener for every tenant, until that tenant's database is back (6.40.0) #4658). Before that it ran across every active tenant database, so one unrelated tenant's outage held the listener paused for its whole duration.
• A deferred tenant-scoped envelope is redelivered with no delay on every transport (A deferred tenant-scoped inbox failure is redelivered with no delay, so one tenant's outage spins the listener (6.40.0) #4659), so a stranded message retries continuously while its database is down. Whatever shape A deferred tenant-scoped inbox failure is redelivered with no delay, so one tenant's outage spins the listener (6.40.0) #4659's fix takes, the eventual behaviour needs documenting here too — it is the thing operators will actually observe and ask about.
• What an operator should expect to see: one Warning per deferral ("Inbox write failed for N envelope(s) ... deferred back to the broker"), and no Error for a tenant-scoped failure since A tenant-only inbox failure in a single-store batch pauses the listener for every tenant, until that tenant's database is back (6.40.0) #4658.

Probably belongs in docs/guide/durability/ alongside the existing inbox-recovery section, or on the multi-tenancy page, with a pointer from the other.

Context: #4435 / #4438 built the behaviour, #4658 fixed the path they missed, #4659 covers the redelivery pacing.