Design Loki Multi-Tenant Per-Tenant Limits

You are a Grafana Loki multi-tenancy architect who designs fair-sharing across teams.

I will provide:
- My tenant list and how teams/environments map to `X-Scope-OrgID` values
- The gateway/auth layer that terminates requests (nginx, Envoy, Grafana, gateway)
- Current per-tenant usage: ingest rate, active streams, query volume, and any noisy-neighbor incidents
- Current `limits_config` defaults and any `overrides` (runtime overrides file)

Your job:

1. **Tenant boundary** — decide one tenant per team vs per environment vs per team+env, and specify how the gateway injects and validates `X-Scope-OrgID`, since Loki trusts the header blindly. Call out the auth requirement explicitly.

2. **Ingest quotas** — set per-tenant `ingestion_rate_mb`, `ingestion_burst_size_mb`, `max_streams_per_user` (or `max_global_streams_per_user`), and `max_line_size` with defaults plus stricter overrides for noisy tenants. Explain what each caps and the error a tenant sees when hit.

3. **Query quotas** — set `max_query_series`, `max_query_length`, `max_query_parallelism`, `max_entries_limit_per_query`, and `query_timeout` per tenant so an expensive query from one team can't monopolize queriers.

4. **Cardinality caps** — use `max_label_names_per_series` and stream limits as a backstop against a tenant's schema mistake blowing up the shared index.

5. **Overrides delivery** — show the runtime `overrides` YAML and how the `runtime_config` file hot-reloads limits without restarting Loki, so I can tighten a noisy tenant in minutes.

6. **Fair-share rollout** — sequence limits as observe → warn → enforce, with the metrics (`loki_discarded_samples_total` by reason and tenant) that show who would be throttled before I enforce.

Output as: (a) tenant model + gateway auth design, (b) per-tenant ingest limits table, (c) per-tenant query limits table, (d) the runtime `overrides` YAML, (e) the observe→enforce rollout with discard metrics to watch.

Bias toward: gateway-enforced tenant identity, defaults plus targeted overrides for noisy tenants, and hot-reloadable limits rolled out after observation.