feat(P2): USD Foundation — canonical part identity + material overrides

M1 — USD exporter:
- render-worker/scripts/export_step_to_usd.py (631 lines)
  Full XCAF traversal, one UsdGeom.Mesh per leaf part,
  schaeffler:partKey on every prim, index-space sharpEdgeVertexPairs
- render-worker/Dockerfile: usd-core>=24.11 installed (USD 0.26.3)

M2 — usd_master MediaAsset + pipeline auto-chain:
- migrations 060 (usd_master enum), 061 (3 JSONB columns),
  062 (rename tessellation settings keys)
- generate_usd_master_task: runs export_step_to_usd.py, upserts
  usd_master MediaAsset, writes resolved_material_assignments to CadFile
- Auto-chained from generate_gltf_geometry_task after every GLB export
- step_tasks.py shim re-exports generate_usd_master_task

M3 — scene-manifest API:
- part_key_service.py: build_scene_manifest(), generate_part_key(),
  four-layer material priority resolution with provenance
- SceneManifest / PartEntry Pydantic models in products/schemas.py
- GET /api/cad/{id}/scene-manifest endpoint (graceful fallback to
  parsed_objects when USD not yet generated)
- POST /api/cad/{id}/generate-usd-master endpoint
- frontend/src/api/sceneManifest.ts: fetchSceneManifest(),
  triggerUsdMasterGeneration()

M4 — manual-material-overrides API:
- GET/PUT /api/cad/{id}/manual-material-overrides endpoints
- CadFile.manual_material_overrides JSONB column (migration 061)
- getManualOverrides() / saveManualOverrides() in cad.ts

M5 — ThreeDViewer partKey integration:
- export_step_to_gltf.py injects partKeyMap into GLB extras
- ThreeDViewer: partKeyMap extraction, resolvePartKey(), effectiveMaterials
  merges legacy partMaterials + new manualOverrides (server-side persistence)
- MaterialPanel: dual-path save (partKey vs legacy), provenance badge,
  reconciliation panel for unmatched/unassigned parts

Also:
- Admin.tsx: generate-missing-usd-masters + canonical scenes bulk actions
- ProductDetail.tsx: usd_master row in asset table
- vite-env.d.ts: fix ImportMeta.env TypeScript error
- GPUProbeResult: add timestamp/devices/render_time_s fields

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/pipeline/tasks/render_thumbnail.py

@@ -26,6 +26,10 @@ def render_step_thumbnail(self, cad_file_id: str):
     pl.step_start("render_step_thumbnail", {"cad_file_id": cad_file_id})
     logger.info(f"Rendering thumbnail for CAD file: {cad_file_id}")
 
+    # Resolve and log tenant context at task start (required for RLS)
+    from app.core.tenant_context import resolve_tenant_id_for_cad, set_tenant_context_sync
+    _tenant_id = resolve_tenant_id_for_cad(cad_file_id)
+
     # Compute and persist STEP file hash for STL cache lookups
     try:
         from sqlalchemy import create_engine
@@ -37,6 +41,7 @@ def render_step_thumbnail(self, cad_file_id: str):
         sync_url = app_settings.database_url.replace("+asyncpg", "")
         _eng = create_engine(sync_url)
         with Session(_eng) as _sess:
+            set_tenant_context_sync(_sess, _tenant_id)
             _cad = _sess.get(CadFile, cad_file_id)
             if _cad and _cad.stored_path and not _cad.step_file_hash:
                 _hash = compute_step_hash(_cad.stored_path)
@@ -71,6 +76,7 @@ def render_step_thumbnail(self, cad_file_id: str):
         _sync_url2 = _cfg2.database_url.replace("+asyncpg", "")
         _eng2 = create_engine(_sync_url2)
         with Session(_eng2) as _sess2:
+            set_tenant_context_sync(_sess2, _tenant_id)
             _cad2 = _sess2.get(_CadFile2, cad_file_id)
             _step_path = _cad2.stored_path if _cad2 else None
         _eng2.dispose()
@@ -82,6 +88,7 @@ def render_step_thumbnail(self, cad_file_id: str):
             if bbox_data:
                 _eng2 = create_engine(_sync_url2)
                 with Session(_eng2) as _sess2:
+                    set_tenant_context_sync(_sess2, _tenant_id)
                     _cad2 = _sess2.get(_CadFile2, cad_file_id)
                     if _cad2:
                         _cad2.mesh_attributes = {**(  _cad2.mesh_attributes or {}), **bbox_data}
@@ -107,6 +114,7 @@ def render_step_thumbnail(self, cad_file_id: str):
         _sync_url3 = _cfg3.database_url.replace("+asyncpg", "")
         _eng3 = create_engine(_sync_url3)
         with Session(_eng3) as _sess3:
+            set_tenant_context_sync(_sess3, _tenant_id)
             _cad3 = _sess3.get(_CadFile3, cad_file_id)
             _attrs = _cad3.mesh_attributes or {} if _cad3 else {}
             _step_path3 = _cad3.stored_path if _cad3 else None
@@ -117,6 +125,7 @@ def render_step_thumbnail(self, cad_file_id: str):
             if edge_data:
                 _eng3 = create_engine(_sync_url3)
                 with Session(_eng3) as _sess3:
+                    set_tenant_context_sync(_sess3, _tenant_id)
                     _cad3 = _sess3.get(_CadFile3, cad_file_id)
                     if _cad3:
                         _cad3.mesh_attributes = {**(_cad3.mesh_attributes or {}), **edge_data}
@@ -145,6 +154,7 @@ def render_step_thumbnail(self, cad_file_id: str):
         _sync_url = _cfg.database_url.replace("+asyncpg", "")
         _eng = create_engine(_sync_url)
         with _Session(_eng) as _s:
+            set_tenant_context_sync(_s, _tenant_id)
             _cad = _s.get(_CadFile, cad_file_id)
             _tid = str(_cad.tenant_id) if _cad and _cad.tenant_id else None
         _eng.dispose()
@@ -176,6 +186,11 @@ def regenerate_thumbnail(self, cad_file_id: str, part_colors: dict):
     pl = PipelineLogger(task_id=self.request.id)
     pl.step_start("regenerate_thumbnail", {"cad_file_id": cad_file_id})
     logger.info(f"Regenerating thumbnail for CAD file: {cad_file_id}")
+
+    # Resolve and log tenant context at task start (required for RLS)
+    from app.core.tenant_context import resolve_tenant_id_for_cad
+    _tenant_id = resolve_tenant_id_for_cad(cad_file_id)
+
     try:
         from app.services.step_processor import regenerate_cad_thumbnail
         success = regenerate_cad_thumbnail(cad_file_id, part_colors)