feat(multitenancy): add identity, sessions, RBAC, and RLS (P3)

[Adel7418]

Summary

This is the second pull request in the multi-tenant platform chain and targets feat/multitenant-p2-postgresql so the review contains only P3.

• add users, workspaces and memberships with atomic personal-workspace bootstrap
• add opaque server-side sessions, secure __Host- cookies, rotation, logout and expiry handling
• add CSRF/same-origin enforcement, security headers and centralized RBAC
• add PostgreSQL RLS and a sanitized two-user isolation matrix across HTTP, service, repository and raw SQL surfaces

Security correction

Strict review found that the initial RLS policy trusted only the workspace GUC. The final correction binds access to both the workspace and an active membership for current_user_id, fails closed for missing/mismatched context, uses a locked NOLOGIN helper role, and includes real PostgreSQL RED→GREEN isolation coverage.

Verification

• full suite: 791 passed, 1 skipped
• independent targeted verifier suite: 30 passed
• Ruff, mypy, compileall, OpenAPI sync, tracked-secret scan, dependency audit, Compose and diff checks: PASS
• evidence/verifier/final strict fallback reviewer: PASS / NONE
• final reviewer findings: 0 HIGH, 0 MEDIUM
• reviewed P3 content SHA: d94c10c7755f84d75fab5fa4855c13b138e62d22
• final stacked merge head: 077c08a0a331812fda73a17433341e7375a06cea
• canonical P2→P3 fingerprint: 1baeef6b7f318e639401696e9efcf702091890f241eab2f79700b76b50dfb5cc
• the final merge inherits only P2's two-file Docker test-harness correction; the P2→P3 patch bytes and fingerprint remain identical to the reviewed P3 patch
• final stacked-head Evidence and independent verifier: PASS / NONE
• final stacked-head bounded reviewer: PASS / NONE, 0 HIGH/MEDIUM
• PR-triggered CI, Security, P1 quality, and P2 PostgreSQL migrations: PASS on the final head

Scope boundary

P4 OAuth/PKCE, token vault, provider connections, UI and background jobs are intentionally out of scope.

• no production deploy or live provider call
• no real credentials or customer data
• merge remains a separate action after the stacked base is ready