Multi-tenancy: strict per-connection isolation

One scratchpad stream on one literal topic. Pick Acme below and everything this connection touches will live under @t/acme/... - a Globex tab literally cannot subscribe to it, not even by hand-rolled wire frames. The handlers are byte-identical to a single-tenant app; the framework scopes the topics, the app scopes its own Redis keys via ctx.tenantId.