test(260716-n46): add coverage for getMimecastClientForTenant

Covers the already-implemented per-tenant factory: returns a MimecastClient
instance, builds a new independent instance per call (never the cached
global), doesn't affect getMimecastClient()'s singleton, and defaults
base_url when omitted. Uses fake credentials only.

lib/services/mimecast-client.test.ts

@@ -7,7 +7,12 @@
  */
 
 import { describe, it, expect, beforeEach } from 'vitest';
-import { isMimecastConfigured, getMimecastClient, _resetMimecastClient } from './mimecast-client';
+import {
+  isMimecastConfigured,
+  getMimecastClient,
+  getMimecastClientForTenant,
+  _resetMimecastClient,
+} from './mimecast-client';
 
 beforeEach(() => {
   delete process.env.MIMECAST_CLIENT_ID;
@@ -61,3 +66,40 @@ describe('getMimecastClient', () => {
     expect(second).not.toBe(first);
   });
 });
+
+describe('getMimecastClientForTenant', () => {
+  // Fake credentials only — never real mimecast_tenants values.
+  const FAKE_TENANT = { client_id: 'tid', client_secret: 'tsecret', base_url: 'https://tenant.example' };
+
+  it('returns a MimecastClient instance exposing the fan-out methods', () => {
+    const client = getMimecastClientForTenant(FAKE_TENANT);
+    expect(client).toBeTruthy();
+    expect(typeof client.searchDeliveredMessages).toBe('function');
+    expect(typeof client.getHeldMessages).toBe('function');
+    expect(typeof client.getThreatEvents).toBe('function');
+  });
+
+  it('returns a NEW instance on each call — never the cached global', () => {
+    const first = getMimecastClientForTenant(FAKE_TENANT);
+    const second = getMimecastClientForTenant(FAKE_TENANT);
+    expect(second).not.toBe(first);
+  });
+
+  it('does not populate or replace the cached global getMimecastClient() instance', () => {
+    process.env.MIMECAST_CLIENT_ID = 'id1';
+    process.env.MIMECAST_CLIENT_SECRET = 'secret1';
+
+    getMimecastClientForTenant(FAKE_TENANT);
+    const global1 = getMimecastClient();
+    const global2 = getMimecastClient();
+
+    // The global singleton is unaffected by tenant-client construction —
+    // still cached and independent of the tenant instance.
+    expect(global2).toBe(global1);
+    expect(global1).not.toBe(getMimecastClientForTenant(FAKE_TENANT));
+  });
+
+  it('does not throw when base_url is omitted (defaults to the Mimecast API host)', () => {
+    expect(() => getMimecastClientForTenant({ client_id: 'tid', client_secret: 'tsecret' })).not.toThrow();
+  });
+});