fix: propagate account_id through all write paths missing NOT NULL coverage

Service layer (production code):
- branch_manager: set account_id on SessionBranch (root + fork) and ForkPoint
  from session.account_id; load session in create_fork for this purpose
- handoff_manager: set account_id on SessionHandoff from session.account_id
- ai_suggestions endpoint: set account_id on AISuggestion from current_user
- steps endpoint (/feedback): set account_id on StepRating from current_user
- ratings endpoint: set account_id on StepRating from current_user

Test infrastructure:
- conftest.py: seed PLATFORM_ACCOUNT_ID (00000000-...-0001) account after
  Base.metadata.create_all so global categories and gallery items have a valid FK
- test_rls_isolation: add _ensure_rls_schema fixture that runs
  'alembic upgrade head' before module tests — previous function-scoped
  test_db fixtures drop the schema, leaving the RLS tests with no tables
- test_branding: create Account before User in helper functions
- test_admin_gallery: set account_id=PLATFORM_ACCOUNT_ID on Tree/ScriptTemplate
- test_public_templates: set account_id=PLATFORM_ACCOUNT_ID on Tree,
  ScriptTemplate, TreeCategory
- test_resolution_outputs: set account_id=session.account_id on
  SessionResolutionOutput
- test_analytics_phase5: set account_id on PsaPostLog
- test_draft_trees: replace account_id=None with PLATFORM_ACCOUNT_ID in
  migration default test (NOT NULL now enforced)
- test_maintenance_schedules: set account_id on other_tree
- test_save_session_as_tree: set account_id on all 5 Session() constructors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_rls_isolation.py

@@ -16,7 +16,10 @@ Run with:
 The test DB is patherly_test (matches conftest.py default).
 """
 import os
+import subprocess
+import sys
 import uuid
+from pathlib import Path
 
 import asyncpg
 import pytest
@@ -37,7 +40,25 @@ ACCOUNT_B_ID = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
 # ---------------------------------------------------------------------------
 
 @pytest.fixture(scope="module")
-async def admin_conn():
+def _ensure_rls_schema():
+    """Re-apply Alembic migrations before the module runs.
+
+    Function-scoped test_db fixtures in other modules drop and recreate the
+    public schema using Base.metadata.create_all, which does not enable RLS
+    or create DB roles. This fixture re-runs 'alembic upgrade head' so that
+    the full migration-managed schema (including RLS policies) is in place.
+    """
+    backend_dir = Path(__file__).parent.parent
+    subprocess.run(
+        [sys.executable, "-m", "alembic", "upgrade", "head"],
+        cwd=backend_dir,
+        check=True,
+        capture_output=True,
+    )
+
+
+@pytest.fixture(scope="module")
+async def admin_conn(_ensure_rls_schema):
     """Superuser asyncpg connection for fixture setup and teardown."""
     conn = await asyncpg.connect(_ADMIN_DSN)
     yield conn