Tenant databases

Point each tenant at its own Postgres β€” data + admin DBs, stored encrypted

Super-admin: point each tenant at its own Postgres. DSNs are stored encrypted; passwords are never shown. No connection β‡’ the shared default DB (unchanged).