Use local example credentials and a dedicated database:

```bash
export DATABASE_URL='sqlite://writing-app.db?mode=rwc'
export EXAMPLE_TOKENS='{ "maya-token": { "tenant": "acme", "user": "maya" }, "ken-token": { "tenant": "acme", "user": "ken" }, "northwind-token": { "tenant": "northwind", "user": "maya" } }'
export BIND_ADDR='127.0.0.1:4011'
rent generate
rent migrate dev --name initial
cargo nextest run
cargo run
```

The opaque tokens are configured on the server for this local example. In a deployed application,
replace that lookup with your identity provider's verification and membership checks. Keep the
same scoped-client boundary in the handlers. Never accept a tenant or principal from an unverified header.
