Why I went with a shared schema and a tenant_id column instead of a database per business, and what it takes to make that safe.