Tenant isolation — every query, every cache, every log

RLS is the safety net; your code is the actual isolation. tenant_id in every WHERE, per-tenant cache keys, structured logs that include tenantId, and a CI scanner that fails the build on cross-tenant leaks.