AI routes now use requirePermission() + ctx.tenantId to get the tenant, ensuring getModelForTenant() is always called with the correct tenant ID so that stored API keys are used. Fixes norms/parse (was falling back to getModel()) and analyses/structured (was trusting x-tenant-id header). Co-Authored-By: Paperclip <noreply@paperclip.ing>