5708127dbb
ModuleGuard now reads tenantId from req.user?.tenantId as fallback (same pattern as module-registry controller), and throws 403 instead of silently allowing access when no tenant context exists. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>