(fix): address review findings — 1 HIGH, 0 MEDIUM

TenantFilter matched metadataCollection with str_contains, so any user
collection whose name contains "_metadata" (e.g. audit_metadata) would
have its tenant scope relaxed to also return NULL-tenant rows. Restored
strict equality to match the pre-refactor SQL.php behavior and close the
cross-tenant read leak in shared-table mode.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: 2 people

src/Database/Hook/TenantFilter.php

@@ -35,7 +35,7 @@ public function filter(string $table): Condition
         // Check the actual collection name against the metadata collection, not the alias
         $name = $this->collection !== '' ? $this->collection : $table;
 
-        if (! empty($this->metadataCollection) && \str_contains($name, $this->metadataCollection)) {
+        if (! empty($this->metadataCollection) && $name === $this->metadataCollection) {
             return new Condition("({$prefix}_tenant IN (?) OR {$prefix}_tenant IS NULL)", [$this->tenant]);
         }