feat(refactor/phase1): foundation infrastructure for modular pipeline

Phase 1 of PLAN_REFACTOR.md — all four sub-tasks implemented:

1.1 PipelineLogger (backend/app/core/pipeline_logger.py)
  - Structured step_start/step_done/step_error/step_progress API
  - Publishes to Python logging AND Redis SSE via log_task_event
  - Context manager `pl.step("name")` for auto-timing

1.2 RenderJobDocument (backend/app/domains/rendering/job_document.py)
  - Pydantic JSONB schema: state machine + per-step records + timing
  - begin_step/finish_step/fail_step/skip_step helpers
  - Migration 048: adds render_job_doc JSONB column to order_lines
  - OrderLine model updated with render_job_doc field

1.3 TenantContextMiddleware (backend/app/core/middleware.py)
  - Decodes JWT, stores tenant_id + role in request.state
  - get_db updated to auto-apply RLS SET LOCAL from request.state
  - Registered in main.py (runs before every request)
  - JWT now embeds tenant_id claim via create_access_token()
  - Login endpoint passes tenant_id to token creation

1.4 ProcessStep Registry (backend/app/core/process_steps.py)
  - StepName StrEnum with all 20 pipeline step names
  - Single source of truth for log prefixes, DB records, UI labels

Also adds db_utils.py with set_tenant_sync() + get_sync_session()
for use inside Celery tasks (bypass-safe RLS helper).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/database.py

@@ -1,9 +1,13 @@
-from typing import AsyncGenerator, Optional
+from __future__ import annotations
+from typing import TYPE_CHECKING, AsyncGenerator, Optional
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
 from sqlalchemy.orm import DeclarativeBase
 from sqlalchemy import text
 from app.config import settings
 
+if TYPE_CHECKING:
+    from starlette.requests import Request
+
 engine = create_async_engine(
     settings.database_url,
     echo=False,
@@ -23,8 +27,20 @@ class Base(DeclarativeBase):
     pass
 
 
-async def get_db() -> AsyncGenerator[AsyncSession, None]:
+async def get_db(request: "Request | None" = None) -> AsyncGenerator[AsyncSession, None]:
     async with AsyncSessionLocal() as session:
+        # Auto-apply RLS context if TenantContextMiddleware populated request.state
+        if request is not None:
+            tenant_id = getattr(request.state, "tenant_id", None)
+            role = getattr(request.state, "role", None)
+            if tenant_id:
+                if role == "admin":
+                    await session.execute(text("SET LOCAL app.current_tenant_id = 'bypass'"))
+                else:
+                    await session.execute(
+                        text("SET LOCAL app.current_tenant_id = :tid"),
+                        {"tid": tenant_id},
+                    )
         try:
             yield session
         finally: