T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

app/schemas/auth.py

@@ -1,59 +1,36 @@
-"""Pydantic schemas for authentication endpoints."""
+"""Auth schemas."""
 
 from __future__ import annotations
 
 from pydantic import BaseModel, EmailStr, Field
 
-from app.models.user import UserRole
-
-
-class UserRegisterRequest(BaseModel):
-    """Request body for POST /api/v1/auth/register (bootstrap)."""
 
+class LoginRequest(BaseModel):
     email: EmailStr
-    password: str = Field(..., min_length=8, max_length=128)
-    name: str = Field(..., min_length=1, max_length=255)
-    role: UserRole = UserRole.sales_rep
+    password: str = Field(..., min_length=1)
 
 
-class UserLoginRequest(BaseModel):
-    """Request body for POST /api/v1/auth/login (form-data or JSON)."""
-
+class PasswordResetRequest(BaseModel):
     email: EmailStr
-    password: str = Field(..., min_length=1, max_length=128)
 
 
-class TokenResponse(BaseModel):
-    """Response body for successful auth (register/login/refresh)."""
-
-    access_token: str
-    token_type: str = "bearer"
-    expires_in: int  # seconds
+class PasswordResetConfirm(BaseModel):
+    token: str = Field(..., min_length=1)
+    new_password: str = Field(..., min_length=8)
 
 
-class LogoutResponse(BaseModel):
-    """Response body for POST /api/v1/auth/logout.
-
-    The token is deleted client-side; this endpoint exists for consistency and
-    future server-side blacklisting.
-    """
-
-    message: str = "logged out"
+class SwitchTenantRequest(BaseModel):
+    tenant_id: str = Field(..., min_length=1)
 
 
-class RegisterResponse(BaseModel):
-    """Response body for successful registration.
-
-    Returns the user info (without password) plus an access token.
-    """
-
-    user: UserOut
-    access_token: str
-    token_type: str = "bearer"
-    expires_in: int
+class AuthResponse(BaseModel):
+    user_id: str
+    email: str
+    name: str
+    role: str
+    tenant_id: str
+    tenant_name: str | None = None
 
 
-# Late import to avoid circular dependency
-from app.schemas.user import UserOut  # noqa: E402
-
-RegisterResponse.model_rebuild()
+class MessageResponse(BaseModel):
+    message: str