fix: visibility.py Defense-in-Depth tenant_id filter + entity_permissions deleted_at migration + cross-tenant tests

alembic/versions/0068_entity_permissions_deleted_at.py

@@ -0,0 +1,28 @@
+"""Add deleted_at to entity_permissions table.
+
+Revision ID: 0068
+Revises: 0067
+Create Date: 2026-07-29
+
+The EntityPermission model has SoftDeleteMixin but the table was never
+migrated to include the deleted_at column.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0068"
+down_revision = "0067"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("entity_permissions", sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True))
+    op.execute("CREATE INDEX IF NOT EXISTS ix_entity_permissions_deleted_at ON entity_permissions (deleted_at)")
+
+
+def downgrade() -> None:
+    op.drop_index("ix_entity_permissions_deleted_at", table_name="entity_permissions")
+    op.drop_column("entity_permissions", "deleted_at")