- TenantGuard: remove PLATFORM_ADMIN bypass, require tenantId for all users
- lexware-contacts.service: add defensive tenantId check in importAsCompany
and importAsContact with clear BadRequestException message
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>