8320a34035
Middleware runs before guards in NestJS — req.user was always undefined when TenantMiddleware executed, so req.tenantId was never set. Convert to TenantGuard (APP_GUARD, registered after JwtAuthGuard) so it runs after JWT validation and can read req.user.tenantId correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>