feat: tenancy — products + API keys

Product is the only tenant table this service owns (porte table:
organization_id -> product_id, everything below it -- tenant_ref/
branch_ref -- stays an opaque string owned by the consuming product, never
a row here). Bcrypt-hashed API keys (passlib, same CryptContext shape as
the auto's auth.service), generated once by scripts/create_product.py and
never persisted in the clear. require_product (X-Api-Key -> Product, 401
on missing/wrong/soft-deleted) is the porte adaptation of the auto's
require_permission — every /v1/* route will depend on it instead of a JWT
bearer token.

Also ports shared/base_model.py and shared/errors.py verbatim (Global
Constraints: soft delete mixins, structured 409 bodies).

products migration + real "alembic upgrade head" round-trip test
(tests/migrations/, new shared _helpers.py instead of the auto's ad hoc
cross-file _run_psql reuse). 13 tests green via `make k8s-test`.

alembic/env.py

@@ -12,7 +12,7 @@ from fiscal_svc.core.db import Base
 
 # Uncomment as modules gain SQLAlchemy models, so autogenerate can see them
 # (mirrors auto/backend/alembic/env.py's own convention):
-# from fiscal_svc.tenancy import models as tenancy_models  # noqa: F401
+from fiscal_svc.tenancy import models as tenancy_models  # noqa: F401
 # from fiscal_svc.documents import models as documents_models  # noqa: F401
 
 # this is the Alembic Config object, which provides