fix(security): Fix critical permission system issues

Problem 1: Remove legacy role bypass
- Remove role="admin" string bypass in permissions.py resolve_permissions()
- Remove role="admin"/"editor" bypass in auth.py check_permission()
- Remove legacy role string fallback in deps.py require_admin/require_write
- Add migration 0112: Create Role records for built-in roles and link role_id
- KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben

Problem 2: Enforce API token scopes
- Add _token_scopes check in require_permission() in deps.py
- When _token_scopes is set (API token auth), required permission must be in scopes
- When _token_scopes not set (session auth), normal permission check applies

Problem 3: Migration chain verification
- Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029
- user_preferences table confirmed exists in DB
- No duplicate revision IDs found

Problem 4: RLS for remaining tenant tables
- Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id
- Login tables and global tables explicitly excluded
- DB check shows 0 tables currently missing RLS (safety net migration)

Problem 5: Permission cache invalidation on tenant switch
- Add invalidate_permission_cache() call in switch_tenant() for old tenant
- Stale cached permissions from old tenant no longer leak

Problem 6+7: Guest system removal
- Remove get_current_guest() from deps.py
- Remove guest_auth.py router from main.py and routes/__init__.py
- Rewrite guests.py to use regular User/UserTenant with role=guest
- Remove GuestUser/GuestInvitation from models/__init__.py
- Add migration 0113: Migrate guest_users to regular users, drop guest tables
- Update frontend GuestLogin/GuestContacts to redirect to normal pages
- KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest

app/services/auth_service.py

@@ -178,6 +178,7 @@ class AuthService:
             return None
 
         user_id = uuid.UUID(session_data["user_id"])
+        old_tenant_id = uuid.UUID(session_data["tenant_id"])
 
         # Verify user has an ACTIVE membership in target tenant
         ut_q = select(UserTenant).where(
@@ -194,6 +195,17 @@ class AuthService:
         if updated is None:
             return None
 
+        # Invalidate permission cache for old tenant (Problem 5 fix)
+        # Permissions are tenant-scoped — stale cache from old tenant must not leak
+        try:
+            from app.core.permissions import invalidate_permission_cache
+            await invalidate_permission_cache(redis, user_id, old_tenant_id)
+        except Exception:
+            logger.warning(
+                "Failed to invalidate permission cache for user=%s old_tenant=%s on tenant switch",
+                user_id, old_tenant_id, exc_info=True,
+            )
+
         # Fetch tenant name
         tenant_q = select(Tenant).where(Tenant.id == new_tenant_id)
         tenant_result = await db.execute(tenant_q)