feat: scaffold Django multi-tenant project with 5 of 9 apps

Phase 1 scaffolding: config/, core/, base models, AES-256-GCM phone encryption, enums mirror

apps.tenant: Tenant + Domain (django-tenants)

apps.org: 11 models (OrgUnit hierarchy, Staff, audit logs)

apps.account: 4 models (UserAccount as AUTH_USER_MODEL, login/password tracking)

apps.permission: 7 models (RBAC + overrides + datascope + append-only changelog)

apps.region: 5 models (District, BusinessArea, MetroLine, MetroStation, School)

All migrations generated, manage.py check passes

core/middleware/audit.py

@@ -0,0 +1,7 @@
+from django.utils.deprecation import MiddlewareMixin
+
+
+class AuditMiddleware(MiddlewareMixin):
+    def process_request(self, request):
+        request.audit_actor = getattr(request, "user", None)
+        return None