feat(identity,tenancy): invite-only login, companies and forced RLS

[Fluory]

Goal

Staff log in with e-mail and password (invite-only). Every user belongs to a company (Better Auth organization), and every tenant-owned query runs inside withTenant under forced row-level security.

Acceptance criteria

• Given no invitation, when someone signs up, then sign-up is rejected
• Given an invited user, when they log in, then the session carries their active company
• withTenant(companyId, fn) sets app.company_id transaction-locally; repositories cannot be called without a tenant context
• Given companies A and B, when a user of A lists requests, then no row of B is returned – via repository and via raw SQL as app_rw
• Given app_rw, when a row carrying the id of another company is inserted, then RLS rejects it
• Roles admin and clerk; authorize() denies admin-only actions to clerks
• Better Auth pinned to >= 1.7.5 with @better-auth/drizzle-adapter; built-in rate limit uses database storage; only organization + admin plugins

Not part of this task

• SSO / Entra ID, magic link, role-admin UI (invite form + seed script only)

Affected areas

• src/features/identity/
• src/features/tenancy/
• src/db/

Test plan

Criterion	Check
sign-up and login	integration test
cross-tenant read/write	integration test with two tenants, repository and raw SQL
authorize()	unit test

Security/Privacy affected?

Yes – authentication, authorization and tenant isolation. Run security-review before ready-for-review.

Epic: #2 · Architecture: docs/decisions/ADR-0001-pilot-architecture.md

[Fluory]

Claimed by @Fluory (Claude Code cloud session, overnight run) on branch claude/feat-identity-tenancy-4 – stacked on claude/chore-app-skeleton-3 (#21). Draft PR follows within minutes.

---

Generated by Claude Code

[Fluory]

decision-needed (taken the most reversible option, PR #31):

1. Invitation delivery: the pilot sends no e-mails. An admin creates an invitation on /invite and hands over the link /signup?invitation=<id> (7 days valid). Sign-up requires that id and the invited address (security review blocker: e-mail alone allowed takeover). Later: send the link by e-mail (needs SPF/DKIM/DMARC per the security add-on).
2. One company per user (unique index on auth.member.user_id) – matches "possibly several subsidiaries later" only if one person never works for two subsidiaries. Reversible by dropping the index and adding a company switcher.
3. Admin plugin stays mounted as ADR D6 says, but nobody holds its admin role; decide with feat(identity): simple user and role management for admins #30 whether to use it for deactivation or remove it (exceptions register entry).
4. No self-service password reset in the pilot; recovery = operator re-invite (documented in operations.md).

---

Generated by Claude Code