Fix multi-tenant leaks by deriving tenant from user, not request

A multi-tenant SaaS app was resolving the active tenant from the client-controlled request (subdomain/header) instead of the authenticated user's organization membership. This made the client the source of truth, risking data leaks. The fix derives the tenant from the user's organization in middleware, failing closed with a 403 if no org is found.