phase1: separate DB roles, RLS restoration, login on crm_auth

- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role

app/config.py

@@ -22,8 +22,11 @@ class Settings(BaseSettings):
     environment: Literal["development", "production", "testing"] = "development"
     log_level: str = "INFO"
 
-    # Database
+    # Database — separate connections for auth, API, worker, and migrations
     database_url: str = "postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm_test"
+    auth_database_url: str = ""  # Falls back to database_url if empty
+    worker_database_url: str = ""  # Falls back to database_url if empty
+    migration_database_url: str = ""  # Falls back to database_url if empty
     db_pool_size: int = 10
     db_max_overflow: int = 20
     db_echo: bool = False