Background jobs are scoped to a single tenant

Background jobs that query data without a tenant scope pull every tenant's records into a single job execution — a cross-tenant data commingling event that CWE-285 and OWASP A01 both flag. The practical impact: a report generation job produces a file containing all tenants' data, an email campaign job sends emails using the wrong tenant's template, or a cleanup job deletes records it shouldn't. Because jobs run asynchronously with no user context enforcing isolation, the error is often invisible until a tenant reports receiving data that isn't theirs.

Queue one job per tenant, not one job for all tenants. Pass the tenant identifier explicitly in the job payload and use it for every query inside the handler:

// Fan-out: queue one job per tenant
const tenants = await db.organizations.findMany({ select: { id: true } })
for (const tenant of tenants) {
  await queue.add('generate-report', { organizationId: tenant.id })
}

// Job handler — use ONLY the payload's organizationId
async function handleGenerateReport(payload: { organizationId: string }) {
  const docs = await db.documents.findMany({
    where: { organizationId: payload.organizationId }
  })
}

In src/jobs/ handlers, treat the absence of organizationId in the payload as a fatal error — do not fall through to a broad query.