M2a: control schema and local accounts (BR-36) #92

Part of ART Milestone 2 (BR-36; ADR-0003; docs/art/milestone-0-assessment.md §5).

• Alembic migration: control.tenants, control.users, control.memberships(user, tenant, role), control.sessions.
• Local accounts: password hashed with stdlib hashlib.scrypt (no new dependency, works air-gapped).
• POST /api/auth/login returns an opaque session token stored hashed in control.sessions (revocable, expiry). POST /api/auth/logout.
• Bootstrap: a CLI script creates the first tenant and tenant admin.

Verified by: integration tests for login success, wrong password, expired and revoked sessions.

Generated by Claude Code