feat: register RLS transaction-begin listener on app engine at startup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/core/database.py

@@ -1,6 +1,7 @@
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
 from sqlalchemy.orm import DeclarativeBase
 from .config import settings
+from app.core.tenant_context import register_tenant_listener
 
 # Create async engine
 engine = create_async_engine(
@@ -16,6 +17,11 @@ async_session_maker = async_sessionmaker(
     expire_on_commit=False
 )
 
+# Register the RLS tenant context listener on the app engine.
+# Fires at the start of every transaction; issues set_config automatically.
+# Must NOT be called on admin_engine — admin connections bypass RLS.
+register_tenant_listener(engine)
+
 
 class Base(DeclarativeBase):
     """Base class for all database models."""