feat: Multi-tenant ERP support via session variables + RLS

- SET var = value / current_setting('var') for session-scoped variables
- current_user / current_role SQL keywords with auth bridge
- server.nim + httpserver.nim populate ExecutionContext.currentUser/currentRole
- RLS policies can reference current_setting('app.tenant_id') for tenant isolation
- Fixed evalExpr to propagate ctx recursively (fixes current_user in sub-expressions)
- Fixed GROUPING SETS execution (lowerSelect checks selGroupingSetsKind)
- Fixed FTS CREATE INDEX docId mismatch (hash of tableName.$key)
- Fixed all test suites to use isolated temp directories
- Added 5 multi-tenant tests (355 total, all green)
- Updated docs: PLAN_SQL_ADVANCED.md, baraql.md, changelog.md

src/barabadb/query/ast.nim

@@ -40,6 +40,7 @@ type
     nkDisableRLS
     nkGrant
     nkRevoke
+    nkSetVar
 
     # Clauses
     nkFrom
@@ -78,6 +79,8 @@ type
     nkIsExpr
     nkStar
     nkPlaceholder
+    nkCurrentUser
+    nkCurrentRole
 
     # Graph-specific
     nkGraphTraversal
@@ -144,6 +147,10 @@ type
     bkJsonPathText = "->>"
     bkFtsMatch = "@@"
     bkDistance = "<->"
+    bkJsonContains = "@>"
+    bkJsonContainedBy = "<@"
+    bkJsonHasAny = "?|"
+    bkJsonHasAll = "?&"
 
   UnaryOpKind* = enum
     ukNeg = "-"
@@ -317,6 +324,9 @@ type
       rvPrivilege*: string
       rvTable*: string
       rvGrantee*: string
+    of nkSetVar:
+      svName*: string
+      svValue*: string
     of nkApplyMigration:
       amName*: string
     of nkMigrationStatus:
@@ -484,6 +494,10 @@ type
       discard
     of nkPlaceholder:
       discard
+    of nkCurrentUser:
+      discard
+    of nkCurrentRole:
+      discard
     of nkPropertyDef:
       pdName*: string
       pdType*: string