feat(P2): USD Foundation — canonical part identity + material overrides

M1 — USD exporter:
- render-worker/scripts/export_step_to_usd.py (631 lines)
  Full XCAF traversal, one UsdGeom.Mesh per leaf part,
  schaeffler:partKey on every prim, index-space sharpEdgeVertexPairs
- render-worker/Dockerfile: usd-core>=24.11 installed (USD 0.26.3)

M2 — usd_master MediaAsset + pipeline auto-chain:
- migrations 060 (usd_master enum), 061 (3 JSONB columns),
  062 (rename tessellation settings keys)
- generate_usd_master_task: runs export_step_to_usd.py, upserts
  usd_master MediaAsset, writes resolved_material_assignments to CadFile
- Auto-chained from generate_gltf_geometry_task after every GLB export
- step_tasks.py shim re-exports generate_usd_master_task

M3 — scene-manifest API:
- part_key_service.py: build_scene_manifest(), generate_part_key(),
  four-layer material priority resolution with provenance
- SceneManifest / PartEntry Pydantic models in products/schemas.py
- GET /api/cad/{id}/scene-manifest endpoint (graceful fallback to
  parsed_objects when USD not yet generated)
- POST /api/cad/{id}/generate-usd-master endpoint
- frontend/src/api/sceneManifest.ts: fetchSceneManifest(),
  triggerUsdMasterGeneration()

M4 — manual-material-overrides API:
- GET/PUT /api/cad/{id}/manual-material-overrides endpoints
- CadFile.manual_material_overrides JSONB column (migration 061)
- getManualOverrides() / saveManualOverrides() in cad.ts

M5 — ThreeDViewer partKey integration:
- export_step_to_gltf.py injects partKeyMap into GLB extras
- ThreeDViewer: partKeyMap extraction, resolvePartKey(), effectiveMaterials
  merges legacy partMaterials + new manualOverrides (server-side persistence)
- MaterialPanel: dual-path save (partKey vs legacy), provenance badge,
  reconciliation panel for unmatched/unassigned parts

Also:
- Admin.tsx: generate-missing-usd-masters + canonical scenes bulk actions
- ProductDetail.tsx: usd_master row in asset table
- vite-env.d.ts: fix ImportMeta.env TypeScript error
- GPUProbeResult: add timestamp/devices/render_time_s fields

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/pipeline/tasks/extract_metadata.py

@@ -89,6 +89,10 @@ def process_step_file(self, cad_file_id: str):
     pl = PipelineLogger(task_id=self.request.id)
     pl.step_start("process_step_file", {"cad_file_id": cad_file_id})
 
+    # Resolve and log tenant context at task start (required for RLS)
+    from app.core.tenant_context import resolve_tenant_id_for_cad
+    _tenant_id = resolve_tenant_id_for_cad(cad_file_id)
+
     lock_key = f"step_processing_lock:{cad_file_id}"
     r = redis_lib.from_url(app_settings.redis_url)
     acquired = r.set(lock_key, "1", nx=True, ex=600)  # 10-minute TTL
@@ -213,9 +217,14 @@ def reextract_cad_metadata(cad_file_id: str):
     pl = PipelineLogger(task_id=None)
     pl.step_start("reextract_cad_metadata", {"cad_file_id": cad_file_id})
 
+    # Resolve and log tenant context at task start (required for RLS)
+    from app.core.tenant_context import resolve_tenant_id_for_cad, set_tenant_context_sync
+    _tenant_id = resolve_tenant_id_for_cad(cad_file_id)
+
     sync_url = app_settings.database_url.replace("+asyncpg", "")
     eng = create_engine(sync_url)
     with Session(eng) as session:
+        set_tenant_context_sync(session, _tenant_id)
         cad_file = session.get(CadFile, cad_file_id)
         if not cad_file or not cad_file.stored_path:
             logger.warning(f"reextract_cad_metadata: file not found {cad_file_id}")
@@ -229,6 +238,7 @@ def reextract_cad_metadata(cad_file_id: str):
         patch = _bbox_from_glb(str(glb_path)) or _bbox_from_step_cadquery(step_path)
         if patch:
             with Session(eng) as session:
+                set_tenant_context_sync(session, _tenant_id)
                 cad_file = session.get(CadFile, cad_file_id)
                 if cad_file:
                     cad_file.mesh_attributes = {**(cad_file.mesh_attributes or {}), **patch}