One tenant, one truth. This shell drives the S1 flow against the real API: it holds no
business logic and applies no security filtering of its own — every refusal shown here came from the
server.
1. Identity
not authenticated
2. Organization (tenant)
3. Customers (scoped to the selected organization)