feat: Multi-tenant ERP support via session variables + RLS

- SET var = value / current_setting('var') for session-scoped variables
- current_user / current_role SQL keywords with auth bridge
- server.nim + httpserver.nim populate ExecutionContext.currentUser/currentRole
- RLS policies can reference current_setting('app.tenant_id') for tenant isolation
- Fixed evalExpr to propagate ctx recursively (fixes current_user in sub-expressions)
- Fixed GROUPING SETS execution (lowerSelect checks selGroupingSetsKind)
- Fixed FTS CREATE INDEX docId mismatch (hash of tableName.$key)
- Fixed all test suites to use isolated temp directories
- Added 5 multi-tenant tests (355 total, all green)
- Updated docs: PLAN_SQL_ADVANCED.md, baraql.md, changelog.md

src/barabadb/core/httpserver.nim

@@ -108,6 +108,8 @@ proc queryHandler(server: HttpServer): RequestHandler =
       let ctx = newContext(request)
       server.metrics.queriesTotal += 1
 
+      var userId = ""
+      var role = ""
       # Auth check
       if server.config.authEnabled:
         let authHeader = request.headers["Authorization"]
@@ -115,10 +117,12 @@ proc queryHandler(server: HttpServer): RequestHandler =
           ctx.json(%*{"error": "Unauthorized"}, 401)
           return
         let tokenStr = authHeader[7..^1]
-        let (valid, userId, role) = server.verifyToken(tokenStr)
+        let (valid, uid, r) = server.verifyToken(tokenStr)
         if not valid:
           ctx.json(%*{"error": "Unauthorized"}, 401)
           return
+        userId = uid
+        role = r
 
       let body = parseJson(request.body)
       if body == nil or "query" notin body:
@@ -131,6 +135,8 @@ proc queryHandler(server: HttpServer): RequestHandler =
         return
 
       var reqCtx = cloneForConnection(server.ctx)
+      reqCtx.currentUser = userId
+      reqCtx.currentRole = role
       let tokens = tokenize(queryStr)
       let astNode = parse(tokens)