Row-level multi-tenancy support.

When a domain is declared with use Caravela.Domain, multi_tenant: true, the compiler calls inject/1 on the IR to add a tenant_id field (:binary_id, required) to every entity. The generated context module then uses scope_tenant/2 and inject_tenant_id/2 helpers to scope every read by tenant_id and stamp every write with the caller's tenant id.

This module only produces IR updates — the actual scoping helpers live in the context template (see priv/templates/context.eex).