phase0: fix cross-plugin import, remove app.tenant_id, create cross-tenant v2 tests

- Fix report_generator/jobs.py: use DmsContract instead of direct DMS import
- Remove app.tenant_id from set_tenant_context (only app.current_tenant_id)
- Create tests/test_cross_tenant_security_v2.py with real RLS tests using
  unprivileged crm_api role (NOSUPERUSER, NOBYPASSRLS)
- Fix existing tests referencing app.tenant_id
- Git baseline tag v-phase0-baseline at 11d6faa
- Production DB backup at /tmp/crm_backup_20260731_015514.dump

app/core/db/__init__.py

@@ -116,18 +116,15 @@ async def get_db() -> AsyncGenerator[AsyncSession, None]:
 async def set_tenant_context(session: AsyncSession, tenant_id: uuid.UUID | str) -> None:
     """Set PostgreSQL session variable for RLS tenant context.
 
-    Sets both app.current_tenant_id (new standard) and app.tenant_id
-    (legacy, used by migration 0044 policies) for backward compatibility.
+    Sets app.current_tenant_id (the only standard tenant context variable).
+    The legacy app.tenant_id has been removed — all RLS policies now use
+    app.current_tenant_id exclusively.
     """
     tid = str(tenant_id)
     await session.execute(
         text("SELECT set_config('app.current_tenant_id', :tid, true)"),
         {"tid": tid},
     )
-    await session.execute(
-        text("SELECT set_config('app.tenant_id', :tid, true)"),
-        {"tid": tid},
-    )
 
 
 async def set_user_context(

app/plugins/builtins/report_generator/jobs.py

@@ -76,7 +76,9 @@ async def generate_report_job(
         {"dms_file_id": ..., "filename": ..., "format": ..., "size": ...}
     """
     import hashlib
-    from app.plugins.builtins.dms.models import File as DmsFile
+    from app.plugins.builtins.contracts import get_contract_registry
+    _dms_contract = get_contract_registry().get("dms")
+    DmsFile = _dms_contract.DmsFile
 
     async with create_db_session() as db:
         # 1. Fetch template