phase0: fix cross-plugin import, remove app.tenant_id, create cross-tenant v2 tests

- Fix report_generator/jobs.py: use DmsContract instead of direct DMS import
- Remove app.tenant_id from set_tenant_context (only app.current_tenant_id)
- Create tests/test_cross_tenant_security_v2.py with real RLS tests using
  unprivileged crm_api role (NOSUPERUSER, NOBYPASSRLS)
- Fix existing tests referencing app.tenant_id
- Git baseline tag v-phase0-baseline at 11d6faa
- Production DB backup at /tmp/crm_backup_20260731_015514.dump

app/plugins/builtins/report_generator/jobs.py

@@ -76,7 +76,9 @@ async def generate_report_job(
         {"dms_file_id": ..., "filename": ..., "format": ..., "size": ...}
     """
     import hashlib
-    from app.plugins.builtins.dms.models import File as DmsFile
+    from app.plugins.builtins.contracts import get_contract_registry
+    _dms_contract = get_contract_registry().get("dms")
+    DmsFile = _dms_contract.DmsFile
 
     async with create_db_session() as db:
         # 1. Fetch template