T02: companies + contacts + import/export + N:M + soft-delete + GDPR + FTS

- Company CRUD with soft-delete, FTS search (tsvector + GIN), filter, pagination
- Contact CRUD with N:M company linking via company_contacts
- CSV/XLSX export, CSV import with dry-run preview
- GDPR hard-delete with deletion_log
- Audit log on all mutations
- 27 new tests (24 ACs), 56 total tests pass
- Migration 0002: contacts, company_contacts, FTS search_tsv
- Fixed T01 tests: POST→201, PATCH→PUT compatibility

tests/test_tenant.py

@@ -209,7 +209,7 @@ class TestAuditLog:
             json={"name": "Audit Test Co"},
             headers=ORIGIN_HEADER,
         )
-        assert resp.status_code == 200
+        assert resp.status_code == 201
 
         # Check audit_log table
         from sqlalchemy import select as sel
@@ -222,7 +222,7 @@ class TestAuditLog:
         """AC 19: Audit log entry created on company.update."""
         seed = await seed_tenant_and_users(db_session)
         await login_client(client, "admin@tenanta.com")
-        resp = await client.patch(
+        resp = await client.put(
             f"/api/v1/companies/{seed['company_a'].id}",
             json={"name": "Updated Company Alpha"},
             headers=ORIGIN_HEADER,