fix: run TenantMiddleware before session load for Redis multitenant (#980)

UseAsyncSession eagerly calls Session.LoadAsync(), which resolves the
tenant namespace from HttpContext.Items. Since TenantMiddleware ran after
UseAsyncSession, the tenant id was unset at load time and fell back to
"default", so per-subdomain sessions were read from the wrong Redis
namespace and lost across requests. Move TenantMiddleware before the
session middleware so the tenant id is set before the session is loaded.

Co-authored-by: claudiamurialdo <33756655+claudiamurialdo@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

dotnet/src/dotnetcore/GxNetCoreStartup/Startup.cs

@@ -590,16 +590,21 @@ public void Configure(IApplicationBuilder app, Microsoft.AspNetCore.Hosting.IHos
 
 			app.UseRouting();
 			app.UseCookiePolicy();
+
+			ISessionService sessionService = GXSessionServiceFactory.GetProvider();
+			// TenantMiddleware must run before the session is loaded: UseAsyncSession eagerly
+			// calls Session.LoadAsync(), which resolves the tenant namespace from HttpContext.Items.
+			// If the tenant id isn't set yet it falls back to "default", reading from the wrong
+			// Redis namespace and losing per-subdomain session isolation.
+			app.UseMiddleware<TenantMiddleware>();
+
 			if (Preferences.IsBeforeConnectEventConfigured())
 			{
 				app.UseMiddleware<EnableCustomSessionStoreMiddleware>();
 			}
 			app.UseAsyncSession();
 			app.UseStaticFiles();
 
-			ISessionService sessionService = GXSessionServiceFactory.GetProvider();
-			app.UseMiddleware<TenantMiddleware>();
-
 			ConfigureCors(app);
 			ConfigureSwaggerUI(app, baseVirtualPath);