feat(rls): Phase 1 #8 — HeartbeatContext RLS + callsite fixes

[webdevcom01-cell]

Summary

• Migration 20260602000000_rls_phase1_heartbeatcontext: TENANT_DIRECT RLS on HeartbeatContext (SELECT/INSERT/UPDATE/DELETE policies + composite organizationId, id index)
• Hot path batch optimization (context-manager.ts): new processContextForRun(agentId, organizationId) combines prune-expired + read-active + build-prompt into one withOrgContext transaction — 1 SET call instead of 3. Required because this table has the highest write frequency of any Phase 1 table (one upsert per heartbeat cycle per agent)
• BullMQ worker (heartbeat-worker.ts): replaces the three separate pruneContext / getContext / buildContextPrompt calls with processContextForRun(agentId, organizationId) using explicit organizationId from job.data — ALS is empty in BullMQ workers
• Individual functions (getContext, setContext, deleteContext, pruneContext, buildContextPrompt): all gain organizationId param and wrap their queries in withOrgContext — used by route callsites
• Route (/api/agents/[agentId]/heartbeat/context): GET and DELETE fetch organizationId via agent lookup; POST is unchanged (setContext handles it internally via body's organizationId)

ALS context per callsite

Callsite	Org ID source	Treatment
context/route.ts GET	agent lookup	passed to getContext
context/route.ts POST	body (organizationId)	setContext wraps internally
context/route.ts DELETE	agent lookup	withOrgContext direct
heartbeat-worker.ts	job.data.organizationId	processContextForRun (batch)

Test plan

• pnpm precheck — 4/4 pass (TypeScript, vitest 4119 tests, lucide mocks, ESLint) ✅
• CI green
• E2E: existing JWTSessionError flake is pre-existing — ignore
• After merge: apply migration to Railway prod DB
• Flag-on smoke: trigger a heartbeat job — confirm no 42501 on prune/get/build path; confirm context rows visible in GET /api/agents/:id/heartbeat/context

RLS state after this PR

Phase 1: 8/14 live — OrganizationMember, Invitation, CompanyMission, Department, Goal, AgentPermissionGrant, HeartbeatConfig, HeartbeatContext

🤖 Generated with Claude Code