I-01C: add session RBAC idempotency transaction guards

[SayQuan1]

I-01C scope

Implements transaction-bound session, RBAC, idempotency, audit, tenant-scope, and last-admin security primitives.

Changes

• add pure domain authorization and expected-version guards
• add explicit transaction and tenant-lock primitives
• add Argon2id session login, CSRF derivation/validation, logout, session epoch revocation, and millisecond UTC timestamps
• add tenant/actor/method/path/key idempotency with 30-second lease, expired-lease takeover, JSON replay, request-hash conflict, and lease-owner fencing
• add audit-safe append-only writes and user disable/safety_admin revoke with last-active-admin protection
• add isolated MySQL and pure authorization tests
• document I-01C implementation boundary and acceptance evidence

Validation

• python -m ruff check apps packages tests tools/database
• python -m ruff format --check apps packages tests tools/database
• business 6 passed, protocol 4 passed, AI 15 passed
• security unit 7 passed
• isolated MySQL 8.0.33: 50 passed; 43 tables, 115 FKs, schema drift clean
• build_specs.py --check: 16 artifacts; test_readiness_design.py: 148 checks

Review / risks

• security/database changes require two-person review per CONTRIBUTING
• no migration added; no production database or existing local service was touched
• API routes, Origin/rate limiting, full role-grant endpoint, and I-02 application command wiring remain explicitly out of this PR
• OpenAPI validator must be installed from tools/design/requirements.txt for the final contract check

Rollback

Revert this feature commit before enabling application routes; preserve session/audit history and do not delete database records.

[SayQuan1]

@1605009600 审PR

[SayQuan987]

Pass