feat: Multi-tenant ERP support via session variables + RLS

- SET var = value / current_setting('var') for session-scoped variables
- current_user / current_role SQL keywords with auth bridge
- server.nim + httpserver.nim populate ExecutionContext.currentUser/currentRole
- RLS policies can reference current_setting('app.tenant_id') for tenant isolation
- Fixed evalExpr to propagate ctx recursively (fixes current_user in sub-expressions)
- Fixed GROUPING SETS execution (lowerSelect checks selGroupingSetsKind)
- Fixed FTS CREATE INDEX docId mismatch (hash of tableName.$key)
- Fixed all test suites to use isolated temp directories
- Added 5 multi-tenant tests (355 total, all green)
- Updated docs: PLAN_SQL_ADVANCED.md, baraql.md, changelog.md

src/barabadb/core/server.nim

@@ -436,9 +436,11 @@ proc handleClient(server: Server, client: AsyncSocket, clientId: int) {.async.}
       case header.kind
       of mkAuth:
         let tokenStr = parseAuthMessage(cast[seq[byte]](payload))
-        let (valid, userId, _) = verifyToken(secret, tokenStr)
+        let (valid, userId, role) = verifyToken(secret, tokenStr)
         if valid:
           authenticated = true
+          connCtx.currentUser = userId
+          connCtx.currentRole = role
           let okMsg = makeAuthOkMessage(header.requestId)
           await client.send(cast[string](okMsg))
           info("Client " & $clientId & " authenticated as " & userId)