fix: enforce tenant isolation on multi-tenant session and login

[mindsers]

Summary

• Security fix: session cookies shared across *.unitae.app subdomains allowed cross-tenant data access. A user authenticated on one congregation's subdomain could navigate to another subdomain and see their own congregation's data there.
• Adds resolveCongregationFromRequest() to resolve the congregation from the request hostname (subdomain slug or custom domain), and validates it against the session in verifySession() and the login flow.
• Scopes validateCredentials() to the subdomain's congregation so login rejects accounts belonging to other tenants (shows generic "Email ou mot de passe invalide" — no information leakage).
• Adds /congregation-not-found error page for unknown subdomains.
• All tenant checks are no-ops in single-tenant mode (MULTI_TENANT !== 'true').

Test plan

• Log into congregation A's subdomain, navigate to congregation B's subdomain → should see congregation B's login page (session destroyed)
• On congregation B's login page, enter congregation A's credentials → should get "Email ou mot de passe invalide"
• Visit fake-slug.unitae.app → should see "Assemblée non trouvée" error page
• Single-tenant mode (MULTI_TENANT unset) → no behavioral change
• Custom domain congregation access still works
• pnpm test:unit — all 316 tests pass
• pnpm test:typecheck — clean
• pnpm test:lint — clean