feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

server/internal/shared/auth/session_store_test.go

@@ -0,0 +1,52 @@
+package auth
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	goredis "github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSessionStoreRotateRefreshSuccess(t *testing.T) {
+	mr := miniredis.RunT(t)
+	client := goredis.NewClient(&goredis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = client.Close() })
+
+	store := NewSessionStore(client)
+	ctx := context.Background()
+
+	require.NoError(t, store.SaveRefresh(ctx, "old-jti", "old-hash", time.Minute))
+	require.NoError(t, store.RotateRefresh(ctx, "old-jti", "old-hash", "new-jti", "new-hash", 2*time.Minute))
+
+	_, err := store.GetRefresh(ctx, "old-jti")
+	assert.Error(t, err)
+
+	value, err := store.GetRefresh(ctx, "new-jti")
+	require.NoError(t, err)
+	assert.Equal(t, "new-hash", value)
+}
+
+func TestSessionStoreRotateRefreshRejectsMismatch(t *testing.T) {
+	mr := miniredis.RunT(t)
+	client := goredis.NewClient(&goredis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = client.Close() })
+
+	store := NewSessionStore(client)
+	ctx := context.Background()
+
+	require.NoError(t, store.SaveRefresh(ctx, "old-jti", "old-hash", time.Minute))
+
+	err := store.RotateRefresh(ctx, "old-jti", "wrong-hash", "new-jti", "new-hash", 2*time.Minute)
+	require.ErrorIs(t, err, ErrRefreshTokenMismatch)
+
+	value, getErr := store.GetRefresh(ctx, "old-jti")
+	require.NoError(t, getErr)
+	assert.Equal(t, "old-hash", value)
+
+	_, getErr = store.GetRefresh(ctx, "new-jti")
+	assert.Error(t, getErr)
+}