Problem solved: retrofitting multi-tenancy is expensive later
Must include: schema-per-tenant data source routing, tenant-context propagation (thread-local + across async/Kafka boundaries), tenant-aware migrations
Acceptance: two tenants' data never cross-contaminate in a concurrent-request test
