First-class tenant context and isolation guards #361

Area: routing, DI, database, cache, session

Problem

The router can recognize wildcard subdomains, but applications must manually carry tenant identity into database connections, cache keys, sessions, and logs. One missed boundary can expose another tenant's data.

Proposal

Add an opt-in TenantContext middleware contract that resolves a tenant, binds it to the execution context, and provides isolation-aware helpers for database, cache, session, URL generation, and logging.

Acceptance criteria

• Tenant resolution can fail closed before controller execution.
• Tenant-aware services cannot be used without an active tenant when guarded.
• Cache/session prefixes and log context are deterministic.
• Context is cleared after every request and tested under long-lived workers.