nestjs-repository: reject writes that carry another tenant instead of rewriting them

### Use case

When a create or update body carries a tenant the caller does not belong to, the write path has two behaviours today:

- Default merge: the original body wins, so the foreign tenant is written.
- `{ replace: true }` (alpha.12): the hook overwrites the value with the caller's tenant. The row ends up in the right place, but silently: a client bug or a deliberate attempt is hidden, there is no error for the caller and no signal for an audit log.

For tenant isolation the safer default is to refuse, not to correct.

### Proposal

Ship a tenant stamp hook next to the scope hook, with explicit outcomes:

| Tenant value in body | Result |
| --- | --- |
| absent, caller has exactly one tenant | stamped with that tenant (create) |
| present and in the caller's set | kept |
| present and outside the caller's set | `403 Forbidden`, never rewritten |
| absent, caller has zero tenants | `403 Forbidden` |
| absent, caller has two or more tenants | `400 Bad Request`, must specify |
| no actor on context | `401 Unauthorized` |

On update, changing the tenant field is rejected unless explicitly allowed. The exception should map to the HTTP status without an extra filter.

Prior art: Rockets `TenantStampHook` in `packages/rockets-core/src/infrastructure/hooks/tenant-stamp.hook.ts` implements this table.

Start by reading the referenced prior art, `packages/rockets-core/src/infrastructure/hooks/tenant-stamp.hook.ts`, and compare its behavior with the scope hook in this repository. Trace the create and update write paths to find where a tenant stamp hook belongs and how exceptions map to HTTP statuses; done means the listed tenant cases and update restrictions are enforced without silently rewriting a foreign tenant.

Written by the indexing model from the issue text.