switch instance in "discovery" only if all modules installed/upgraded succesfully

Note: this assumes that rollbacks in case of migration errrors in individual module databases are handled by the modules or by the devops.

To ensure that a call to /install or /upgrade does not perform partial system update but only a complete one. Okapi will assume that the "init" on new instances, even if failed, is not destructive to the existing data and instances. It is orchestration's responsibility to assure this is the case.

If any of the modules fail in upgrade, the whole operation will be dropped.
Only if all modules succeed, the tenant will be switched to use the new set of modules and Okapi should report which modules failed and why.

error reporting

All individual tenant init errors should be relayed up to the client.