Multi-tenant feature flags

Design a multi-tenant feature-flag service used by ~5,000 customer organizations, each running their own apps. Flag evaluations happen in-app at ~500K evals/sec aggregate and must add <1ms latency (no network call on the hot path). Flags support boolean, multivariate, and percentage rollouts keyed on user attributes. Admins toggle flags in a dashboard and expect changes to propagate to running services within a few seconds. Read-heavy: ~1M reads per config write.