Phase 1B-B · Tenant authorization

Company access is enforced before accounting data.

Ledger Nook verifies both identity and active company membership for protected requests. Accounting features remain deliberately gated until the tenant boundary is proven against PostgreSQL.