Resolve the tenant from the user, not the request

TL;DR A multi-tenant app was resolving the active tenant from the request (subdomain/header) instead of the authenticated user. That makes the client the source of truth for "which tenant am I" — the wrong place for it. Fix: derive the tenant from the user's organization membership, enforce it in mi