Tenant Isolation You Don't Have to Trust Application Code For

Instead of trusting every handler to filter by `tenantId`, InvocaCare pushes tenant isolation down to AWS IAM itself — a Lambda authorizer calls STS AssumeRole to hand each request credentials that are structurally incapable of reading another tenant's data