The $context Namespace: Tenant Isolation as a Property, Not a Filter — headless.ly