feat: scaffold Django multi-tenant project with 5 of 9 apps

Phase 1 scaffolding: config/, core/, base models, AES-256-GCM phone encryption, enums mirror

apps.tenant: Tenant + Domain (django-tenants)

apps.org: 11 models (OrgUnit hierarchy, Staff, audit logs)

apps.account: 4 models (UserAccount as AUTH_USER_MODEL, login/password tracking)

apps.permission: 7 models (RBAC + overrides + datascope + append-only changelog)

apps.region: 5 models (District, BusinessArea, MetroLine, MetroStation, School)

All migrations generated, manage.py check passes

apps/account/migrations/0002_initial.py

@@ -0,0 +1,50 @@
+# Generated by Django 4.2.16 on 2026-04-29 08:42
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('account', '0001_initial'),
+        ('org', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='useraccount',
+            name='staff',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='account', to='org.staff'),
+        ),
+        migrations.AddIndex(
+            model_name='passwordresettoken',
+            index=models.Index(fields=['user'], name='idx_pw_reset_tokens_user'),
+        ),
+        migrations.AddIndex(
+            model_name='passwordhistory',
+            index=models.Index(fields=['user', '-created_at'], name='idx_pw_histories_user'),
+        ),
+        migrations.AddIndex(
+            model_name='useraccount',
+            index=models.Index(fields=['status'], name='idx_user_accounts_status'),
+        ),
+        migrations.AddIndex(
+            model_name='useraccount',
+            index=models.Index(fields=['staff'], name='idx_user_accounts_staff'),
+        ),
+        migrations.AddConstraint(
+            model_name='useraccount',
+            constraint=models.UniqueConstraint(fields=('username',), name='uq_user_accounts_username'),
+        ),
+        migrations.AddConstraint(
+            model_name='useraccount',
+            constraint=models.UniqueConstraint(condition=models.Q(('email__isnull', False)), fields=('email',), name='uq_user_accounts_email'),
+        ),
+        migrations.AddConstraint(
+            model_name='useraccount',
+            constraint=models.UniqueConstraint(condition=models.Q(('phone_hash__isnull', False)), fields=('phone_hash',), name='uq_user_accounts_phone'),
+        ),
+    ]