fix: guest_sessions Redis index for revocation + RLS on all tenant tables (migration 0064)

app/routes/guest_auth.py

@@ -112,6 +112,9 @@ async def guest_login(
         1800,  # 30 min TTL
         json.dumps(session_data),
     )
+    # Track session in guest index for revocation (P1.6 fix)
+    await redis.sadd(f"guest_sessions:{guest.id}", session_id)
+    await redis.expire(f"guest_sessions:{guest.id}", 1800)
 
     from fastapi.responses import JSONResponse
 
@@ -145,6 +148,14 @@ async def guest_logout(
     session_id = request.cookies.get("guest_session")
     if session_id:
         redis = get_redis()
+        # Remove from guest sessions index (P1.6 fix)
+        guest_data = await redis.get(f"guest_session:{session_id}")
+        if guest_data:
+            import json
+            data = json.loads(guest_data)
+            gid = data.get("guest_user_id")
+            if gid:
+                await redis.srem(f"guest_sessions:{gid}", session_id)
         await redis.delete(f"guest_session:{session_id}")
 
     from fastapi.responses import JSONResponse