rag-tenant — multi-tenant RAG isolated by Postgres row-level security. There's no "WHERE tenant_id = ..." anywhere in the application code — isolation is enforced at the database layer, and a test asserts it stays that way. github.com/0mandrock1/rag-tenant