Multi-Tenant Isolation

Prevent cross-tenant reads/writes by scoping every query to tenant_id from the trusted session.

This room unlocks when you enrol in a linked course or have a matching Learn plan. No separate lab checkout — practice stays inside the track.