Architecture: schema vs database mode
Two isolation models, one API.
Storage modes
Database mode gives each tenant a dedicated database (works on every backend) — the strongest isolation. Schema mode (Postgres-only) shares one database and switches search_path per request — cheapest at high tenant counts. The Org.storage_mode column picks per tenant.
Pick database mode by default
It works on sqlite/mysql/pg and gives physical separation. Reach for schema mode only when you have hundreds of small Postgres tenants and connection budget bites.
cargo run -- create-tenant acme --mode database --database-url postgres://…/acme
cargo run -- create-tenant beta --mode schema # PG only