Resolve context once

A multi-site request should resolve its publication from a trusted hostname and carry that site context through the request path.

Every content lookup should be scoped to that site. A matching slug on a different publication must not make the record visible here.

Scope derived systems too

Tenant separation also applies to caches, uploaded assets, search, and generated links. A correct database filter cannot prevent leakage through a shared cache key.

Tests should intentionally use two sites with similar records and confirm each site receives only its own content and media.