The church is in the path. The session is a cookie. Postgres enforces the rest.
Staff work under /o/your-church. Lectern never infers the church from a JWT or a header.
Row-level security is on and forced. Missing org context fails closed.