phase1: separate DB roles, RLS restoration, login on crm_auth

- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role

.env.example

@@ -1,16 +1,15 @@
 # LeoCRM v1.0 - Environment Variables Template
 
 # === REQUIRED ===
-DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
+DATABASE_URL=postgresql+asyncpg://crm_api:your_password@localhost:5432/crm_db
+AUTH_DATABASE_URL=postgresql+asyncpg://crm_auth:your_password@localhost:5432/crm_db
+WORKER_DATABASE_URL=postgresql+asyncpg://crm_worker:your_password@localhost:5432/crm_db
+MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:your_password@localhost:5432/crm_db
 REDIS_URL=redis://localhost:6379/0
 
 # === REQUIRED for Docker/Production ===
-# Migration DB URL (owner user, can bypass RLS for DDL)
-MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:your_password@localhost:5432/crm_db
 # Redis password (required in Docker)
 REDIS_PASSWORD=your_redis_password
-# Runtime DB password (set crm_runtime role password on startup)
-RUNTIME_DB_PASSWORD=your_runtime_password
 
 # === OPTIONAL (with defaults) ===