Database-level tenancy enforcement.
One household's data is technically prevented from appearing in another's queries. The DB-scoped client refuses any SQL missing a household_id filter.
lib/db/scoped.ts wraps the libSQL client. Every call goes through a regex that confirms the SQL contains a `household_id` predicate. SQL without it throws at runtime — even superadmins can't bypass.
Settings keys that should be per-user (your email, notification preferences, theme) are namespaced as `user_${userId}_${key}` in app_settings. The global allowlist is short and explicit (currency only, for now).