How SaaSQuickStart keeps one customer's data from another: two independent layers — membership-checked tenant resolution plus a per-query tenantId filter, guarded by a CI audit.