Multi-tenant isolation as defense-in-depth: when WHERE owner_user_id isn't enough

Every query that returns user data filters by owner. That's the contract — and one forgotten WHERE clause leaks another tenant's data. Here's a second, automatic layer that fails closed, built on a SQLAlchemy do_orm_execute hook.