Bind estate access to the authenticated tenant context #593

Problem

The API accepts estateId from a request header and uses it to resolve the estate-specific reporting database. The request tenant identifier should be validated against the authenticated principal so a caller cannot select an estate they are not authorized to access.

Relevant areas:

• EstateReportingAPI/Endpoints/*.cs
• EstateReportingAPI/Handlers/*.cs
• EstateReportingAPI.BusinessLogic/QueryTimingInterceptor.cs

Scope

Introduce a single tenant/estate context abstraction that:

• Resolves the estate from authenticated claims or an explicitly validated header.
• Rejects missing, malformed, or unauthorized estate identifiers.
• Is used consistently by all reporting endpoints.
• Preserves the existing integration-test setup through a test-only authentication/context configuration.

Acceptance criteria

• Requests cannot access another estate by changing only the estateId header.
• All protected endpoint groups use the same tenant validation path.
• Unauthorized and invalid tenant requests return consistent HTTP responses.
• Integration tests cover valid access, missing tenant context, and cross-estate access attempts.