Security architecture rewrite.

Shipped: Auth-middleware module, tenant-validation module, employee-context module. Every Cloud Function entry validates auth + tenant + employee scope before touching Firestore. Per-route SecurityLevel enum.