[amar-python]

Fixes #93. This is part 2 of ART Milestone 2 (BR-36; decision 6: schema per tenant).

Behaviour

Request	Runs in	Auth
Authorization: Bearer <session>	schema tenant_<slug> (registry, audit log, uploaded tables)	session (#92)
No Authorization header	the deployment's default schemas, as today	existing API-key gate
Invalid or expired bearer	—	401, never a fallback to the default schemas

What this means for each tenant:

• Other tenants' data is out of reach. A tenant cannot list, read rows from, or delete another tenant's files or tables. Requests without a session see no tenant data.
• Duplicate detection is per tenant. The registry's UNIQUE constraints now apply inside each tenant's schema, so the same file uploaded by two tenants is not a duplicate. This is part of BR-28.
• The audit log is per tenant.
• T&E mode under a tenant session returns 409, with a message pointing to M2b-2: per-tenant T&E tables (BR-36) #99 (per-tenant T&E tables, your 26 Oct decision). This keeps tenants out of the shared T&E schema until their own exists.

How

• api/tenancy.py. The tenant schema is held in a context variable. Services read it through uploads_schema() and te_schema(); the 23 direct reads of settings.UPLOADS_SCHEMA and settings.TE_SCHEMA in services and routers now go through these functions.
• tenant_scope replaces require_api_key on the csv, T&E and audit routers. It's async on purpose: only an async dependency sets the variable in the context that the endpoint's worker thread copies.
• Tenant schemas get the per-tenant migrations. 0004 (the shared control schema) is skipped for tenant runs. A tenant's schema is migrated when scripts/create_tenant_admin.py creates it, and every existing tenant is brought to head at startup ("migrations run across N schemas", decision 6). Migrating a tenant swaps a setting under a lock, so it's restricted to startup and the CLI, never a request.

Evidence

All runs are against local PostgreSQL 16.

Check	Result
Local replica of the CI integration job (scripts/test_report.py --strict)	277 passed, 0 failed, 0 skipped (268 on main + 9 new)
Evals p,i,s,e	26/26
tests/test_tenant_isolation.py	9 passed, three runs in a row
Same tests with tenant routing removed from tenant_scope	6 of 8 fail (as expected; the concurrency test came later)
Concurrency	60 requests across 4 threads (tenant A, tenant B, no session): each saw only its own data
DB-free pytest	126 passed
scripts/lint.sh	clean
CLI end to end	tenant created → schema tenant_<slug> exists → its admin signs in, uploads, and sees only that file

Not in this PR

• Per-tenant T&E tables (M2b-2: per-tenant T&E tables (BR-36) #99).
• The role matrix (M2c: role-based authorisation matrix (BR-36) #94): any member can currently use the data routes.
• OIDC (M2d: OIDC sign-in against a deployment-controlled IdP (BR-36) #95).
• Frontend sign-in (M2e: frontend sign-in and tenant-scoped session (BR-36) #96).

---

Generated by Claude Code