Database-per-site isolation

Every tenant site is provisioned with its own physical database (cms_<slug>), created automatically at seed time. The platform database is the control plane that holds the site registry and shared config.

Reads and writes route to the correct database based on the active tenant, so one tenant can never see another tenant's content.