Router
  PASS  matches route and passes params
  PASS  runs middleware
  PASS  404 for unknown path
  PASS  405 for wrong method
TokenService
  PASS  valid token verifies
  PASS  expired token rejected
  PASS  tampered payload (other tenant) rejected
  PASS  alg=none rejected
  PASS  wrong key rejected
  PASS  short APP_KEY refused
  PASS  garbage rejected
TenantRepository isolation (SQLite stand-in; SQL used is portable)
  PASS  insert forces tenant from context
  PASS  tenant A reads own row
  PASS  tenant A cannot read tenant B row by ID guessing
  PASS  tenant B cannot update tenant A row
  PASS  tenant A row unchanged
  PASS  update cannot move a row to another tenant
  PASS  query without TenantId filter is rejected
  PASS  query with TenantId filter returns only own rows
  PASS  column-name injection rejected
  PASS  tenant id 0 refused

21 passed, 0 failed