gate: migration 0086, crm_migration BYPASSRLS, audit_log fix, CI test for app.tenant_id

- Migration 0086: Remove FORCE RLS from 5 global tables
- Migration 0085: crm_migration keeps BYPASSRLS for data migrations
- Migration 0085: Remove audit_log from crm_auth grants
- auth_service.py: Audit log via separate API session (crm_api with tenant context)
- tests/test_no_legacy_tenant_var.py: CI test for app.tenant_id in policies

app/services/auth_service.py

@@ -109,20 +109,25 @@ class AuthService:
             db, redis, user, tenant.id, role=user_tenant.role
         )
 
-        # Set tenant context for audit log write (auth session uses crm_auth role)
-        from app.core.db import set_tenant_context
-        await set_tenant_context(db, tenant.id)
-
-        # Log the login in audit trail
-        await log_audit(
-            db,
-            tenant.id,
-            user.id,
-            "login",
-            "user",
-            user.id,
-            changes={"email": email},
-        )
+        # Log the login in audit trail via separate API session (crm_api with tenant context)
+        # crm_auth must not write to tenant tables — audit_log is a tenant table
+        try:
+            from app.core.db import get_session_factory, set_tenant_context
+            api_factory = get_session_factory()
+            async with api_factory() as audit_db:
+                await set_tenant_context(audit_db, tenant.id)
+                await log_audit(
+                    audit_db,
+                    tenant.id,
+                    user.id,
+                    "login",
+                    "user",
+                    user.id,
+                    changes={"email": email},
+                )
+                await audit_db.commit()
+        except Exception:
+            logger.warning("Failed to write login audit log via API session", exc_info=True)
 
         # Hook: auth.after_login
         await do_action("auth.after_login", db=db, user=user, tenant=tenant, role=user_tenant.role, session_id=session_id)