Multi-tenant

Tenants distinguished by store_id on main collections. Isolation via application query, not separate database. No middleware auto-scopes store_id — developer must filter manually.