Multi-tenancy: strict per-connection isolation

One scratchpad stream on one literal topic. With Acme active, everything this connection touches lives under @t/acme/... - the Globex tab literally cannot subscribe to it, not even by hand-rolled wire frames. The handlers are byte-identical to a single-tenant app; the framework scopes the topics, the app scopes its own Redis keys via ctx.tenantId.