T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

app/core/event_bus.py

@@ -0,0 +1,41 @@
+"""In-process event bus for publish/subscribe."""
+
+from __future__ import annotations
+
+import asyncio
+from collections import defaultdict
+from typing import Any, Callable, Coroutine
+
+EventHandler = Callable[[dict[str, Any]], Coroutine[Any, Any, None]]
+
+
+class EventBus:
+    """Simple async event bus for in-process pub/sub."""
+
+    def __init__(self) -> None:
+        self._handlers: dict[str, list[EventHandler]] = defaultdict(list)
+
+    def subscribe(self, event_name: str, handler: EventHandler) -> None:
+        """Subscribe a handler to an event."""
+        self._handlers[event_name].append(handler)
+
+    def unsubscribe(self, event_name: str, handler: EventHandler) -> None:
+        """Unsubscribe a handler from an event."""
+        if event_name in self._handlers:
+            self._handlers[event_name] = [h for h in self._handlers[event_name] if h is not handler]
+
+    async def publish(self, event_name: str, payload: dict[str, Any]) -> None:
+        """Publish an event to all subscribers."""
+        handlers = self._handlers.get(event_name, [])
+        tasks = [asyncio.create_task(h(payload)) for h in handlers]
+        if tasks:
+            await asyncio.gather(*tasks, return_exceptions=True)
+
+
+# Global event bus instance
+_event_bus = EventBus()
+
+
+def get_event_bus() -> EventBus:
+    """Get the global event bus."""
+    return _event_bus