Add layered service/API for tenancy and people with the privacy seam

Wires the data model through repository -> service -> API/v1. The privacy engine (app/services/privacy.py) is the single enforcement point: every read resolves visibility there (tree role, tree visibility, per-person override; living-person redaction is a marked Phase 2 TODO). All writes record an attributable AuditEntry.

Endpoints: POST /users (open dev bootstrap until auth), GET /users/me, POST/GET /trees, GET /trees/{id}, and POST/GET /trees/{id}/persons. Authn is a temporary X-User-Id header shim; authz is membership-based (owner/editor/viewer). Domain errors map to 401/403/404/409. Verified on the deploy target: private tree -> 403 for non-members, missing actor -> 401, audit log populated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/api/deps.py

@@ -0,0 +1,33 @@
+"""Shared API dependencies."""
+
+import uuid
+from typing import Annotated
+
+from fastapi import Depends, Header, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_session
+from app.models.user import User
+from app.services.user_service import get_user
+
+SessionDep = Annotated[AsyncSession, Depends(get_session)]
+
+
+async def get_current_user(
+    session: SessionDep,
+    x_user_id: Annotated[uuid.UUID | None, Header()] = None,
+) -> User:
+    """TEMPORARY pre-auth shim: identifies the caller via the ``X-User-Id``
+    header. Replaced by the AuthProvider (sessions/tokens) in the auth slice.
+    The assistant principal will also be minted here, scoped to its user."""
+    if x_user_id is None:
+        raise HTTPException(
+            status.HTTP_401_UNAUTHORIZED, "X-User-Id header required (pre-auth)"
+        )
+    user = await get_user(session, x_user_id)
+    if user is None:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "unknown user")
+    return user
+
+
+CurrentUser = Annotated[User, Depends(get_current_user)]