T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

app/models/__init__.py

@@ -1,37 +1,16 @@
-"""SQLAlchemy ORM models for the CRM system."""
+"""SQLAlchemy models for LeoCRM."""
 
-from app.models.account import Account, AccountSize, Industry
-from app.models.activity import Activity, ActivityType
-from app.models.base import Base, OrgScopedMixin, SoftDeleteMixin, TimestampMixin
-from app.models.contact import Contact
-from app.models.deal import Deal, DealStage
-from app.models.deal_stage_history import DealStageHistory
-from app.models.note import Note, NoteParentType
-from app.models.org import Org
-from app.models.tag import Tag
-from app.models.tag_link import TagLink, TagLinkParentType
-from app.models.user import User, UserRole
+from app.models.tenant import Tenant
+from app.models.user import User, UserTenant
+from app.models.role import Role
+from app.models.session import Session
+from app.models.audit import AuditLog, DeletionLog
+from app.models.notification import Notification
+from app.models.auth import PasswordResetToken, ApiToken
+from app.models.company import Company
 
 __all__ = [
-    "Account",
-    "AccountSize",
-    "Activity",
-    "ActivityType",
-    "Base",
-    "Contact",
-    "Deal",
-    "DealStage",
-    "DealStageHistory",
-    "Industry",
-    "Note",
-    "NoteParentType",
-    "Org",
-    "OrgScopedMixin",
-    "SoftDeleteMixin",
-    "Tag",
-    "TagLink",
-    "TagLinkParentType",
-    "TimestampMixin",
-    "User",
-    "UserRole",
+    "Tenant", "User", "UserTenant", "Role", "Session",
+    "AuditLog", "DeletionLog", "Notification",
+    "PasswordResetToken", "ApiToken", "Company",
 ]