fix(arch-001,arch-002): permissions before on_activate; activate once per process

app/main.py

@@ -284,22 +284,23 @@ async def lifespan(app: FastAPI):
                 logger.info(f"Plugin {name} is inactive — skipping activation")
                 continue
 
-            # Activate plugin with a FRESH session per plugin to avoid RLS state leakage
-            # RLS fail-closed requires app.current_tenant_id for tenant-table writes.
-            # Plugin activation may fail on duplicate cron job inserts — this is harmless
-            # since cron jobs already exist from previous startups.
+            # Activate plugin ONCE per process (ARCH-002 fix): a fresh session with
+            # the first tenant's RLS context satisfies fail-closed RLS for any
+            # tenant-table writes during activation. Plugins that need per-tenant
+            # data must seed it themselves (e.g. via the default-tenant mechanism).
+            # Calling on_activate once prevents duplicate event listeners, cron
+            # jobs, mini-apps and other contributions at multi-tenant startups.
             plugin_activated = False
-            for tenant_id in all_tenant_ids:
+            if all_tenant_ids:
                 try:
                     async with async_session() as plugin_db:
-                        await set_tenant_context(plugin_db, tenant_id)
+                        await set_tenant_context(plugin_db, all_tenant_ids[0])
                         await plugin.on_activate(plugin_db, container, event_bus)
                         await plugin_db.flush()
                         await plugin_db.commit()
                     plugin_activated = True
                 except Exception as exc:
-                    logger.warning(f"[STARTUP] Plugin {name} activation issue for tenant {tenant_id}: {exc}")
-                    break
+                    logger.warning(f"[STARTUP] Plugin {name} activation issue: {exc}")
 
             if plugin_activated:
                 plugin_record.status = "active"