Security basics

Tenant isolation is enforced by the Go API and PostgreSQL RLS. Optional tenant-admin MFA is planned for the focused MFA release.