Scope default_pool to the uploading tenant

Scope default_pool to the uploading tenant default_pool selected the oldest 'instant' storage pool across all tenants, but provisioning creates one pool per tenant, so every tenant after the first recorded object_placements against another tenant's pool -- corrupting the pool-level KMS fallback and tiering price lookups. Thread tenant_id through and filter on it. Regression test: an older decoy tenant's pool must not capture acme's placement.