Tenant databases
Point each tenant at its own Postgres β data + admin DBs, stored encrypted
Super-admin: point each tenant at its own Postgres. DSNs are stored encrypted; passwords are never shown. No connection β the shared default DB (unchanged).