T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

app/routes/notifications.py

@@ -0,0 +1,69 @@
+"""Notification routes."""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_db
+from app.core.notifications import (
+    get_unread_count, list_notifications, mark_notification_read,
+)
+from app.deps import get_current_user
+
+router = APIRouter(prefix="/api/v1/notifications", tags=["notifications"])
+
+
+@router.get("")
+async def list_notifications_endpoint(
+    page: int = Query(1, ge=1),
+    page_size: int = Query(25, ge=1, le=100),
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """List notifications (unread first)."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    return await list_notifications(db, tenant_id, user_id, page, page_size)
+
+
+@router.patch("/{notification_id}/read")
+async def mark_notification_read_endpoint(
+    notification_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Mark a notification as read."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    try:
+        nid = uuid.UUID(notification_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid notification_id", "code": "invalid_id"})
+
+    notif = await mark_notification_read(db, tenant_id, user_id, nid)
+    if notif is None:
+        raise HTTPException(404, detail={"detail": "Notification not found", "code": "not_found"})
+
+    return {
+        "id": str(notif.id),
+        "type": notif.type,
+        "title": notif.title,
+        "body": notif.body,
+        "read_at": notif.read_at.isoformat() if notif.read_at else None,
+        "created_at": notif.created_at.isoformat() if notif.created_at else None,
+    }
+
+
+@router.get("/unread-count")
+async def unread_count_endpoint(
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Get unread notification count."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    count = await get_unread_count(db, tenant_id, user_id)
+    return {"count": count}