gate: migration 0086, crm_migration BYPASSRLS, audit_log fix, CI test for app.tenant_id

- Migration 0086: Remove FORCE RLS from 5 global tables
- Migration 0085: crm_migration keeps BYPASSRLS for data migrations
- Migration 0085: Remove audit_log from crm_auth grants
- auth_service.py: Audit log via separate API session (crm_api with tenant context)
- tests/test_no_legacy_tenant_var.py: CI test for app.tenant_id in policies

alembic/versions/0085_restore_tenant_rls.py

@@ -78,7 +78,6 @@ AUTH_TABLES = {
     "tenants": ["SELECT"],
     "password_reset_tokens": ["SELECT", "INSERT", "UPDATE", "DELETE"],
     "sessions": ["SELECT", "INSERT", "UPDATE", "DELETE"],
-    "audit_log": ["SELECT", "INSERT"],
 }
 
 WORKER_GLOBAL_TABLES = {
@@ -98,8 +97,9 @@ def upgrade() -> None:
     # Step 1: Create crm_platform_admin role
     _exec("DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_platform_admin') THEN CREATE ROLE crm_platform_admin NOSUPERUSER NOBYPASSRLS NOLOGIN; END IF; END $$;")
 
-    # Step 2: Fix crm_migration role — remove BYPASSRLS
-    _exec("ALTER ROLE crm_migration NOBYPASSRLS")
+    # Step 2: crm_migration keeps BYPASSRLS for data migrations (NOSUPERUSER)
+    # crm_migration is the table owner and needs to run tenant-wide data migrations
+    _exec("ALTER ROLE crm_migration NOSUPERUSER BYPASSRLS")
 
     # Step 3: Transfer ALL table ownership to crm_migration
     for table in ALL_TABLES:

alembic/versions/0086_fix_global_tables_force_rls.py

@@ -0,0 +1,38 @@
+"""Fix FORCE RLS on global tables.
+
+Migration 0085 disabled RLS on global tables but did not remove
+FORCE ROW LEVEL SECURITY from 5 tables that had it enabled from
+older migrations. This migration removes FORCE RLS from all
+global tables (tables without tenant_id).
+
+Revision ID: 0086
+Revises: 0085
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0086"
+down_revision = "0085"
+branch_labels = None
+depends_on = None
+
+
+GLOBAL_TABLES_WITH_FORCE_RLS = [
+    "api_tokens",
+    "sequences",
+    "sessions",
+    "tenant_plugin_activation",
+    "user_tenants",
+]
+
+
+def upgrade() -> None:
+    for table in GLOBAL_TABLES_WITH_FORCE_RLS:
+        op.execute(f"ALTER TABLE public.{table} NO FORCE ROW LEVEL SECURITY")
+
+
+def downgrade() -> None:
+    for table in GLOBAL_TABLES_WITH_FORCE_RLS:
+        op.execute(f"ALTER TABLE public.{table} FORCE ROW LEVEL SECURITY")