fix: replace ALS-based db scoping with closure-based scoped client

[mindsers]

Summary

• Root cause fix: the Prisma 7 pg adapter breaks AsyncLocalStorage after async queries, making ALS-based tenant scoping unreliable. A previous module-level fallback caused cross-tenant data leaks in production due to race conditions between concurrent requests.
• New approach: createScopedDb(congregationId) creates a Prisma $extends client that captures congregationId in a JavaScript closure — completely immune to ALS propagation issues.
• authenticateAndAuthorize() now returns a scoped db client alongside currentUser, congregation, session, and can().
• All service functions (30+ files) receive db: ScopedDb as their first parameter instead of importing the global db.
• LimitService constructor takes db as first parameter.
• Background worker uses createScopedDb() directly for tenant isolation.
• Docs updated to reflect the new architecture (OSS-focused, no SaaS-specific content).

Supersedes #13 and #12 which used ALS-based workarounds.

Test plan

• Log into a congregation → see only that congregation's data
• Create/edit/delete records → changes apply to the correct congregation
• Navigate all pages — no "Congregation context is required" errors
• pnpm test:unit — 322 tests pass
• pnpm test:typecheck — clean
• pnpm test:lint — clean