Helpers for enforcing explicit tenant scope on query APIs.
DripDrop allows global records with tenant_key: nil, but callers must be
explicit when they intend that global scope. Omitting the key entirely is
rejected so list/get helpers do not accidentally leak rows across tenants.
Summary
Functions
Fetches tenant_key from a filter map, raising when it is absent.
Raises a consistent tenant-scope error for deprecated unscoped APIs.