fix: enforce tenant data isolation and prevent silent cross-tenant leaks

[mindsers]

Summary

• Unauthenticated route validation: login, password-forgot, and password-reset pages now validate the subdomain via resolveCongregationFromRequest() and redirect to /congregation-not-found for unknown subdomains.
• Data scoping fix: the Prisma 7 pg adapter breaks AsyncLocalStorage context after awaited queries. The scoped db extension silently fell through to unscoped queries, returning data from all congregations. Now it throws on missing context (fail-safe) and re-enters context after each query.
• verifyRole context restoration: verifyRole() re-enters ALS context before returning, so subsequent db queries in loaders have the correct tenant scope.
• Replaces real congregation name (Lyon Confluence) with generic placeholder in seed and register UI.

Builds on #11 which handled session/login tenant validation.

Test plan

• Log into congregation A, navigate to congregation B → see B's login page (session destroyed)
• On congregation B's login, use congregation A's credentials → "Email ou mot de passe invalide"
• Visit unknown subdomain → "Assemblée non trouvée" error page
• Log into congregation A → see only congregation A's data (users, territories, publishers)
• Single-tenant mode (MULTI_TENANT unset) → no behavioral change
• pnpm test:unit — 316 tests pass
• pnpm test:typecheck — clean
• pnpm test:lint — clean