phase1: separate DB roles, RLS restoration, login on crm_auth

- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role

app/core/db/__init__.py

@@ -55,13 +55,22 @@ class TenantMixin(TimestampMixin, SoftDeleteMixin):
     tenant_id: Mapped[uuid.UUID] = mapped_column(PGUUID(as_uuid=True), nullable=False, index=True)
 
 
-# Global engine and session factory
+# Global engines and session factories — separate per role
 _engine: AsyncEngine | None = None
 _session_factory: async_sessionmaker[AsyncSession] | None = None
 
+_auth_engine: AsyncEngine | None = None
+_auth_session_factory: async_sessionmaker[AsyncSession] | None = None
+
+_worker_engine: AsyncEngine | None = None
+_worker_session_factory: async_sessionmaker[AsyncSession] | None = None
+
+_migration_engine: AsyncEngine | None = None
+_migration_session_factory: async_sessionmaker[AsyncSession] | None = None
+
 
 def get_engine() -> AsyncEngine:
-    """Get or create the global async engine."""
+    """Get or create the global async engine (crm_api role)."""
     global _engine
     if _engine is None:
         settings = get_settings()
@@ -75,7 +84,7 @@ def get_engine() -> AsyncEngine:
 
 
 def get_session_factory() -> async_sessionmaker[AsyncSession]:
-    """Get or create the global session factory."""
+    """Get or create the global session factory (crm_api role)."""
     global _session_factory
     if _session_factory is None:
         _session_factory = async_sessionmaker(
@@ -86,6 +95,99 @@ def get_session_factory() -> async_sessionmaker[AsyncSession]:
     return _session_factory
 
 
+def get_auth_engine() -> AsyncEngine:
+    """Get or create the auth engine (crm_auth role).
+
+    Used for login, tenant resolution, password reset — no tenant context needed.
+    Falls back to the main engine if AUTH_DATABASE_URL is not set.
+    """
+    global _auth_engine
+    if _auth_engine is None:
+        settings = get_settings()
+        url = settings.auth_database_url or settings.database_url
+        _auth_engine = create_async_engine(
+            url,
+            pool_size=settings.db_pool_size,
+            max_overflow=settings.db_max_overflow,
+            echo=settings.db_echo,
+        )
+    return _auth_engine
+
+
+def get_auth_session_factory() -> async_sessionmaker[AsyncSession]:
+    """Get or create the auth session factory (crm_auth role)."""
+    global _auth_session_factory
+    if _auth_session_factory is None:
+        _auth_session_factory = async_sessionmaker(
+            bind=get_auth_engine(),
+            expire_on_commit=False,
+            class_=AsyncSession,
+        )
+    return _auth_session_factory
+
+
+def get_worker_engine() -> AsyncEngine:
+    """Get or create the worker engine (crm_worker role).
+
+    Used by ARQ worker for background job processing.
+    Falls back to the main engine if WORKER_DATABASE_URL is not set.
+    """
+    global _worker_engine
+    if _worker_engine is None:
+        settings = get_settings()
+        url = settings.worker_database_url or settings.database_url
+        _worker_engine = create_async_engine(
+            url,
+            pool_size=settings.db_pool_size,
+            max_overflow=settings.db_max_overflow,
+            echo=settings.db_echo,
+        )
+    return _worker_engine
+
+
+def get_worker_session_factory() -> async_sessionmaker[AsyncSession]:
+    """Get or create the worker session factory (crm_worker role)."""
+    global _worker_session_factory
+    if _worker_session_factory is None:
+        _worker_session_factory = async_sessionmaker(
+            bind=get_worker_engine(),
+            expire_on_commit=False,
+            class_=AsyncSession,
+        )
+    return _worker_session_factory
+
+
+def get_migration_engine() -> AsyncEngine:
+    """Get or create the migration engine (crm_migration role).
+
+    Used by Alembic for DDL operations. This engine connects as the table owner.
+    Falls back to the main engine if MIGRATION_DATABASE_URL is not set.
+    """
+    global _migration_engine
+    if _migration_engine is None:
+        settings = get_settings()
+        url = settings.migration_database_url or settings.database_url
+        _migration_engine = create_async_engine(
+            url,
+            pool_size=2,
+            max_overflow=0,
+            echo=settings.db_echo,
+        )
+    return _migration_engine
+
+
+def get_migration_session_factory() -> async_sessionmaker[AsyncSession]:
+    """Get or create the migration session factory (crm_migration role)."""
+    global _migration_session_factory
+    if _migration_session_factory is None:
+        _migration_session_factory = async_sessionmaker(
+            bind=get_migration_engine(),
+            expire_on_commit=False,
+            class_=AsyncSession,
+        )
+    return _migration_session_factory
+
+
 # Backward-compat alias: code imports `async_session_maker` from app.core.db.
 # Behaves like the session factory — calling it returns an AsyncSession.
 # We use a wrapper class so `async with async_session_maker() as db:` works.
@@ -102,7 +204,10 @@ async_session_maker = _AsyncSessionMakerWrapper()
 
 
 async def get_db() -> AsyncGenerator[AsyncSession, None]:
-    """FastAPI dependency: yield an async database session."""
+    """FastAPI dependency: yield an async database session (crm_api role).
+
+    Used for normal API requests with tenant context set via RLS.
+    """
     factory = get_session_factory()
     async with factory() as session:
         try:
@@ -113,6 +218,38 @@ async def get_db() -> AsyncGenerator[AsyncSession, None]:
             raise
 
 
+async def get_auth_db() -> AsyncGenerator[AsyncSession, None]:
+    """FastAPI dependency: yield an auth database session (crm_auth role).
+
+    Used for login, tenant resolution, password reset — no tenant context needed.
+    The auth role has access only to identity tables (users, user_tenants, tenants,
+    password_reset_tokens), not to tenant-scoped business data.
+    """
+    factory = get_auth_session_factory()
+    async with factory() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+
+
+async def get_worker_db() -> AsyncGenerator[AsyncSession, None]:
+    """FastAPI dependency: yield a worker database session (crm_worker role).
+
+    Used by ARQ worker for background job processing with tenant context.
+    """
+    factory = get_worker_session_factory()
+    async with factory() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+
+
 async def set_tenant_context(session: AsyncSession, tenant_id: uuid.UUID | str) -> None:
     """Set PostgreSQL session variable for RLS tenant context.
 
@@ -175,17 +312,39 @@ async def create_db_session(
 
 
 async def close_engine() -> None:
-    """Dispose the global engine (for shutdown)."""
-    global _engine, _session_factory
-    if _engine is not None:
-        await _engine.dispose()
-        _engine = None
-        _session_factory = None
+    """Dispose all global engines (for shutdown)."""
+    global _engine, _session_factory, _auth_engine, _auth_session_factory
+    global _worker_engine, _worker_session_factory, _migration_engine, _migration_session_factory
+    for eng in (_engine, _auth_engine, _worker_engine, _migration_engine):
+        if eng is not None:
+            await eng.dispose()
+    _engine = None
+    _session_factory = None
+    _auth_engine = None
+    _auth_session_factory = None
+    _worker_engine = None
+    _worker_session_factory = None
+    _migration_engine = None
+    _migration_session_factory = None
 
 
 def reset_engine_for_testing(engine: AsyncEngine) -> async_sessionmaker[AsyncSession]:
-    """Replace the global engine with a test engine. Returns a session factory."""
+    """Replace all global engines with a test engine. Returns a session factory.
+
+    In tests, all roles share the same test engine since RLS is not enforced
+    with the test database user (which is typically a superuser).
+    """
     global _engine, _session_factory
+    global _auth_engine, _auth_session_factory
+    global _worker_engine, _worker_session_factory
+    global _migration_engine, _migration_session_factory
     _engine = engine
     _session_factory = async_sessionmaker(bind=engine, expire_on_commit=False, class_=AsyncSession)
+    # In tests, all engines point to the same test DB
+    _auth_engine = engine
+    _auth_session_factory = _session_factory
+    _worker_engine = engine
+    _worker_session_factory = _session_factory
+    _migration_engine = engine
+    _migration_session_factory = _session_factory
     return _session_factory