Route auth and tenant isolation, checked

Identity is decided once, in the auth walk, and everything else reads it. firmSession() verifies the app's (fake) signed session token and returns a user principal with tenantId and role attributes; nothing downstream looks at the request body or the tool input for either. The decision that matters most is where the session-ownership check lives: eve's route auth says who is calling but has no per-session access list, so a guard at your HTTP boundary records each session's owner on create and checks it on every follow-up, answer and stream. The same map is checked again inside the walk, so calling eve directly can't cross firms either.