RAG and tenant isolation

Not written yet

This module is scoped and scheduled but its content has not been written. When it ships it will cover: Filter inside the query, never after retrieval. Separate indexes per trust zone.

Every module in the curriculum is listed from day one so the shape of the whole course is visible. An empty page is more honest than a hidden one.