feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware

- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string

Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)

backend/WorkClub.Infrastructure/Data/Interceptors/SaveChangesTenantInterceptor.cs

@@ -0,0 +1,70 @@
+using Finbuckle.MultiTenant;
+using Finbuckle.MultiTenant.Abstractions;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.Extensions.Logging;
+using WorkClub.Domain.Interfaces;
+
+namespace WorkClub.Infrastructure.Data.Interceptors;
+
+public class SaveChangesTenantInterceptor : SaveChangesInterceptor
+{
+    private readonly IMultiTenantContextAccessor _tenantAccessor;
+    private readonly ILogger<SaveChangesTenantInterceptor> _logger;
+
+    public SaveChangesTenantInterceptor(
+        IMultiTenantContextAccessor tenantAccessor,
+        ILogger<SaveChangesTenantInterceptor> logger)
+    {
+        _tenantAccessor = tenantAccessor;
+        _logger = logger;
+    }
+
+    public override ValueTask<InterceptionResult<int>> SavingChangesAsync(
+        DbContextEventData eventData,
+        InterceptionResult<int> result,
+        CancellationToken cancellationToken = default)
+    {
+        SetTenantIdForNewEntities(eventData.Context);
+        return base.SavingChangesAsync(eventData, result, cancellationToken);
+    }
+
+    public override InterceptionResult<int> SavingChanges(
+        DbContextEventData eventData,
+        InterceptionResult<int> result)
+    {
+        SetTenantIdForNewEntities(eventData.Context);
+        return base.SavingChanges(eventData, result);
+    }
+
+    private void SetTenantIdForNewEntities(DbContext? context)
+    {
+        if (context == null) return;
+
+        var tenantId = _tenantAccessor.MultiTenantContext?.TenantInfo?.Identifier;
+        
+        if (string.IsNullOrWhiteSpace(tenantId))
+        {
+            _logger.LogWarning("No tenant context available for SaveChanges");
+            return;
+        }
+
+        var addedEntries = context.ChangeTracker
+            .Entries()
+            .Where(e => e.State == EntityState.Added && e.Entity is ITenantEntity)
+            .ToList();
+
+        foreach (var entry in addedEntries)
+        {
+            if (entry.Entity is ITenantEntity tenantEntity)
+            {
+                if (string.IsNullOrWhiteSpace(tenantEntity.TenantId))
+                {
+                    tenantEntity.TenantId = tenantId;
+                    _logger.LogDebug("Set TenantId for entity {EntityType}: {TenantId}", 
+                        entry.Entity.GetType().Name, tenantId);
+                }
+            }
+        }
+    }
+}

backend/WorkClub.Infrastructure/Data/Interceptors/TenantDbConnectionInterceptor.cs

@@ -0,0 +1,88 @@
+using System.Data.Common;
+using Finbuckle.MultiTenant;
+using Finbuckle.MultiTenant.Abstractions;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace WorkClub.Infrastructure.Data.Interceptors;
+
+public class TenantDbConnectionInterceptor : DbConnectionInterceptor
+{
+    private readonly IMultiTenantContextAccessor _tenantAccessor;
+    private readonly ILogger<TenantDbConnectionInterceptor> _logger;
+
+    public TenantDbConnectionInterceptor(
+        IMultiTenantContextAccessor tenantAccessor,
+        ILogger<TenantDbConnectionInterceptor> logger)
+    {
+        _tenantAccessor = tenantAccessor;
+        _logger = logger;
+    }
+
+    public override async ValueTask<InterceptionResult> ConnectionOpeningAsync(
+        DbConnection connection,
+        ConnectionEventData eventData,
+        InterceptionResult result,
+        CancellationToken cancellationToken = default)
+    {
+        await base.ConnectionOpeningAsync(connection, eventData, result, cancellationToken);
+
+        var tenantId = _tenantAccessor.MultiTenantContext?.TenantInfo?.Identifier;
+        
+        if (string.IsNullOrWhiteSpace(tenantId))
+        {
+            _logger.LogWarning("No tenant context available for database connection");
+            return result;
+        }
+
+        if (connection is NpgsqlConnection npgsqlConnection)
+        {
+            await using var command = npgsqlConnection.CreateCommand();
+            command.CommandText = $"SET LOCAL app.current_tenant_id = '{tenantId}'";
+            
+            try
+            {
+                await command.ExecuteNonQueryAsync(cancellationToken);
+                _logger.LogDebug("Set tenant context for database connection: {TenantId}", tenantId);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to set tenant context for connection");
+                throw;
+            }
+        }
+
+        return result;
+    }
+
+    public override void ConnectionOpened(DbConnection connection, ConnectionEndEventData eventData)
+    {
+        base.ConnectionOpened(connection, eventData);
+
+        var tenantId = _tenantAccessor.MultiTenantContext?.TenantInfo?.Identifier;
+        
+        if (string.IsNullOrWhiteSpace(tenantId))
+        {
+            _logger.LogWarning("No tenant context available for database connection");
+            return;
+        }
+
+        if (connection is NpgsqlConnection npgsqlConnection)
+        {
+            using var command = npgsqlConnection.CreateCommand();
+            command.CommandText = $"SET LOCAL app.current_tenant_id = '{tenantId}'";
+            
+            try
+            {
+                command.ExecuteNonQuery();
+                _logger.LogDebug("Set tenant context for database connection: {TenantId}", tenantId);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to set tenant context for connection");
+                throw;
+            }
+        }
+    }
+}