Private account isolation by stable UUID

Private rows belong to a random stable account UUID rather than being keyed directly from email and passphrase.

• Automatic tenant filters scope ordinary reads and writes.
• No user tasks, routines, schedules, or profiles are public or indexable.
• Passphrases use slow salted hashes, and forgotten credentials cannot be recovered.