phase1: fix auth_service tenant context for audit_log, add sessions+audit_log to crm_auth grants

- auth_service.py: set tenant context before audit log write in login
- migration 0085: add sessions and audit_log to AUTH_TABLES for crm_auth
- Login now works on production with RLS enabled

alembic/versions/0085_restore_tenant_rls.py

@@ -77,6 +77,8 @@ AUTH_TABLES = {
     "user_tenants": ["SELECT"],
     "tenants": ["SELECT"],
     "password_reset_tokens": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "sessions": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "audit_log": ["SELECT", "INSERT"],
 }
 
 WORKER_GLOBAL_TABLES = {

app/services/auth_service.py

@@ -109,6 +109,10 @@ class AuthService:
             db, redis, user, tenant.id, role=user_tenant.role
         )
 
+        # Set tenant context for audit log write (auth session uses crm_auth role)
+        from app.core.db import set_tenant_context
+        await set_tenant_context(db, tenant.id)
+
         # Log the login in audit trail
         await log_audit(
             db,