[WM-IMP-11] Tenant isolation tests absent from CI pipeline

## WM-IMP-11 — Tenant Isolation Tests Not in CI

**Category:** Improvement | **Priority:** Low

### Observation
Tenant isolation tests (verifying that Tenant A cannot access Tenant B data) are not present in the CI pipeline. Given the cross-tenant cache bleed bug (BUG-3), this gap is especially concerning.

### Recommendation
Add tenant isolation regression tests to CI that run on every PR.

### Acceptance Criteria
- [ ] Test suite added: verifies Tenant A data not accessible from Tenant B context across all data types
- [ ] Tests run in CI on every PR
- [ ] Tests cover: API endpoints, cache layer, database queries, document generation
- [ ] Tests fail the build if isolation is broken