full ingestion -> OCR -> extraction flow is now working correctly.

libs/security/dependencies.py

@@ -41,6 +41,11 @@ def get_current_tenant(request: Request) -> str | None:
         if role.startswith("tenant:"):
             return str(role.split(":", 1)[1])
 
+    # Check for explicit tenant header (useful for testing/API keys)
+    tenant_header = request.headers.get("X-Tenant-ID")
+    if tenant_header:
+        return tenant_header
+
     # Default tenant for development
     return "default"