Multi-tenancy in .NET 10: isolating tenant data with EF Core named query filters

Make cross-tenant data leaks fail closed by default: resolve the tenant once, filter every query with an EF Core 10 named filter, and block foreign writes in SaveChanges.