fix: enforce tenant data isolation and centralize auth

[mindsers]

Summary

• Subdomain validation: unauthenticated routes (login, password-forgot, password-reset) now validate the subdomain and redirect to /congregation-not-found for unknown subdomains
• Data scoping fix: the Prisma 7 pg adapter breaks AsyncLocalStorage after awaited queries, causing the scoped db client to silently return unscoped data. The extension now throws on missing context (fail-safe) and re-enters context after each query
• authenticateAndAuthorize() wrapper: replaces the fragile 3-step pattern (verifySession + verifyRole + restoreCongregationContext) across 83 route files with a single function call. Returns a can(Role) function for cleaner permission checks. Role checks run via Promise.all (faster than sequential)
• Fallback for concurrent loaders: module-level fallback in the db extension handles cases where React Router runs parallel loaders that break each other's ALS context
• Code comments in English: translated all French comments introduced in this branch

Builds on #11 which handled session/login tenant validation.

Test plan

• Log into congregation A, navigate to congregation B → see B's login page (session destroyed)
• On congregation B's login, use congregation A's credentials → "Email ou mot de passe invalide"
• Visit unknown subdomain → "Assemblée non trouvée" error page
• Log into congregation A → see only congregation A's data (users, territories, publishers)
• Navigate all pages — no context errors in console
• Single-tenant mode (MULTI_TENANT unset) → no behavioral change
• pnpm test:unit — 321 tests pass
• pnpm test:typecheck — clean
• pnpm test:lint — clean