feat: implement tenant isolation with PostgreSQL RLS

- users + tenant_memberships tables (tenant-scoped)
- RLS policy on tenant_memberships using set_config('app.current_tenant_id', ...)
- withTenantContext() helper for transaction-scoped tenant context
- separate non-superuser app role (b2bcall_app): the default Docker postgres
  user is SUPERUSER and always bypasses RLS even with FORCE, so the app must
  never connect through the migration/owner role. Documented in
  docs/TENANT_ISOLATION.md.
- automated isolation test proving tenant A never sees tenant B's data

.env.example

@@ -1,2 +1,5 @@
 FREESWITCH_PAT=
 DATABASE_URL=postgresql://user:password@localhost:5432/b2bcall?schema=public
+POSTGRES_APP_USER=
+POSTGRES_APP_PASSWORD=
+APP_DATABASE_URL=postgresql://user:password@localhost:5432/b2bcall?schema=public