security: Add proper authentication, RBAC, and tenant isolation

- Add password hashing with bcrypt
- Add AuthService with proper login
- Add password strength validation
- Add RBAC middleware (AdminOnly, ManagerOrAdmin)
- Add tenant isolation middleware
- Update CRM handler with tenant filtering
- Add JWT fallback for development mode
- Add user context helpers
- Build successful

backend/handlers/crm.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"time"
 
+	"boc/middleware"
+
 	"github.com/go-chi/chi/v5"
 	"github.com/lib/pq"
 )
@@ -69,13 +71,15 @@ func (h *CRMHandler) ListCustomers(w http.ResponseWriter, r *http.Request) {
 		status = "active"
 	}
 
+	tenantID := middleware.GetTenantFromContext(r.Context())
+
 	rows, err := h.DB.Query(`
 		SELECT id, name, email, phone, company, org_number, status, source, tags, assigned_to, created_at, updated_at
 		FROM boc_customers
-		WHERE status = $1
+		WHERE status = $1 AND tenant_id = $2
 		ORDER BY created_at DESC
 		LIMIT 100
-	`, status)
+	`, status, tenantID)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "database error")
 		return