feat(permission): seed 154 PermissionDefs + 7 builtin roles + matrix + lookups + tenant auto-seed

- data migration apps/permission_def/0002_seed_permission_defs: 154 PermissionDef rows in public schema
- service apps.permission.services.seed_default_roles: 7 builtin roles + 154x7 RolePermission matrix
- service apps.setting.services.seed_default_lookups: LookupGroup/LookupItem defaults per DATA_MODEL_SETTING.md sec 2.3
- apps.tenant.signals: post_save Tenant handler auto-seeds new tenants inside schema_context, errors logged not raised
- apps.tenant.apps.ready() registers the signal

apps/tenant/apps.py

@@ -5,3 +5,8 @@ class TenantConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
     name = "apps.tenant"
     label = "tenant"
+
+    def ready(self):
+        from apps.tenant import signals  # noqa: F401
+
+        signals._register()

apps/tenant/signals.py

@@ -0,0 +1,36 @@
+import logging
+
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+
+logger = logging.getLogger(__name__)
+
+
+def _get_tenant_model():
+    from django.apps import apps
+    return apps.get_model("tenant", "Tenant")
+
+
+def _register():
+    Tenant = _get_tenant_model()
+
+    @receiver(post_save, sender=Tenant)
+    def on_tenant_created(sender, instance, created, **kwargs):
+        if not created:
+            return
+        if instance.schema_name == "public":
+            return
+
+        from django_tenants.utils import schema_context
+
+        from apps.permission.services import seed_default_roles
+        from apps.setting.services import seed_default_lookups
+
+        try:
+            with schema_context(instance.schema_name):
+                seed_default_roles(instance.schema_name)
+                seed_default_lookups(instance.schema_name)
+        except Exception:
+            logger.exception(
+                "Failed to seed defaults for tenant %s", instance.schema_name
+            )