Multi-tenant from day one — per-session factory + scoped everything

createMcpServer({ tenantId }) per session, ScopedDb wrapper, tenant_id in every query, tenant cache keys. The architecture that makes cross-tenant leaks impossible-by-default.