T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

app/schemas/user.py

@@ -1,55 +1,37 @@
-"""Pydantic schemas for User endpoints."""
+"""User schemas."""
 
 from __future__ import annotations
 
-from datetime import datetime
+from typing import Any
 
-from pydantic import BaseModel, ConfigDict, EmailStr, Field
-
-from app.models.user import UserRole
+from pydantic import BaseModel, EmailStr, Field
 
 
-class UserOut(BaseModel):
-    """Response schema for a user (never includes password_hash)."""
-
-    model_config = ConfigDict(from_attributes=True)
-
-    id: int
+class UserCreate(BaseModel):
     email: EmailStr
-    name: str
-    role: UserRole
-    org_id: int
-    avatar_url: str | None = None
-    email_notifications: bool = True
-    created_at: datetime
+    name: str = Field(..., min_length=1, max_length=200)
+    password: str = Field(..., min_length=8)
+    role: str = Field(default="viewer")
+    is_active: bool = True
 
 
 class UserUpdate(BaseModel):
-    """Request body for PATCH /api/v1/users/{id} (admin or self)."""
-
-    name: str | None = Field(None, min_length=1, max_length=255)
-    avatar_url: str | None = Field(None, max_length=1024)
-    email_notifications: bool | None = None
-    role: UserRole | None = None  # admin-only
+    name: str | None = Field(None, min_length=1, max_length=200)
+    role: str | None = None
+    is_active: bool | None = None
 
 
-class UserCreateRequest(BaseModel):
-    """Request body for POST /api/v1/users (admin-only)."""
-
-    email: EmailStr
-    password: str = Field(..., min_length=8, max_length=128)
-    name: str = Field(..., min_length=1, max_length=255)
-    role: UserRole = UserRole.sales_rep
+class UserResponse(BaseModel):
+    id: str
+    email: str
+    name: str
+    role: str
+    is_active: bool
+    tenant_id: str
 
 
-class UserListResponse(BaseModel):
-    """Response schema for paginated user list."""
-
-    items: list[UserOut]
+class PaginatedUsers(BaseModel):
+    items: list[UserResponse]
     total: int
     page: int
     page_size: int
-
-
-# Re-export for late import in auth.py
-__all__ = ["UserCreateRequest", "UserListResponse", "UserOut", "UserUpdate"]