P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check

tests/test_abac.py

@@ -421,4 +421,3 @@ class TestABACPolicyService:
             db_session, tenant_id, policy["id"], enabled=False
         )
         assert updated["enabled"] is False
-}

tests/test_entity_permissions.py

@@ -403,4 +403,3 @@ class TestEntityPermissions:
             db_session, tenant_id, viewer_id, "contact", contact_id
         )
         assert access == "none", "Permission should be gone after cleanup"
-}

tests/test_permission_performance.py

@@ -286,4 +286,3 @@ class TestPermissionPerformance:
         assert elapsed < 3.0, f"get_visible_ids with mixed ownership took {elapsed:.3f}s (expected <3.0s)"
         # Viewer should see: 200 shared + 300 tenant-owned = 500
         assert len(visible) >= 500, f"Expected >=500 visible, got {len(visible)}"
-}