P5: Per-user entitlement scoping on every tool call

Imported from GitHub issue El-SaMa/oma#66 by @El-SaMa.

The agent can only act within the caller's org and product scope.