D1 — Single-DB + Postgres RLS (confirmed)
Architecture decision record, relocated verbatim from the retired single-file
docs/tenancy/decision log. Status, thematic clusters, and how to record a new ADR: the decision log index.
Isolation is enforced at the database layer by RLS policies, not only by application
query scopes. Even a missing where tenant_id = ? cannot leak rows across tenants.
Rationale: defence-in-depth for a fintech; the DB is the last line of defence.