fix: RLS auth bypass for signup/login flows

- Add set_config('app.tenant_id') before user INSERT in signup tx
- Add 004_auth_rls_fix.sql: permissive SELECT on users/api_keys for
  auth lookups, INSERT on users with tenant context check
- db-setup now runs migrations on every up (idempotent)

products/05-aws-cost-anomaly/src/auth/middleware.ts

@@ -222,6 +222,9 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
         role = 'owner';
       }
 
+      // Set tenant context for RLS before inserting user
+      await client.query("SELECT set_config('app.tenant_id', $1, true)", [tenantId]);
+
       const user = await client.query(
         `INSERT INTO users (tenant_id, email, password_hash, role) VALUES ($1, $2, $3, $4) RETURNING id`,
         [tenantId, body.email, passwordHash, role],