feat: implement SaaS product integration trust boundary (US1 MVP)

Implements tasks T001-T020 from specs/002-saas-integration/tasks.md
(Setup, Foundational, and User Story 1 - the P1 MVP: every inbound
request is authenticated and trusted before anything happens).
User Story 2 (admin onboarding/rotation/revocation) and User Story 3
(rate limiting) are not yet implemented (T021-T032 remain).

Schema (prisma/schema.prisma + initial migration):
- Replace the placeholder Product model (leftover starter-template
  scaffolding: code/description/ProductStatus enum) with the real
  docs/06-database-schema.md shape (externalProductId,
  supportEnabled, status).
- Add ProductIntegration (credential ref, rotation/revocation state,
  allowed scope, per-integration/per-user rate limits) and
  CustomerReference models.
- Align AuditLog to docs/06's shape (actor/actorType/entityType/
  entityId/reason/metadata) -- the placeholder shape had no fields
  to satisfy this feature's audit requirements.

Auth:
- HMAC-signed short-lived tokens (issue/verify) with jti-based replay
  defense via Redis and a bounded clock-skew tolerance.
- Credential secrets are AES-256-GCM encrypted at rest (new required
  INTEGRATION_CREDENTIAL_ENCRYPTION_KEY env var) since no secret
  manager exists in this stack yet -- see research.md "Credential
  storage".
- New product-integration-auth.plugin.ts Fastify plugin runs the
  validation order in contracts/inbound-request-contract.md and
  populates request.reqContext only on full success; every attempt
  (success or failure) is audit-logged without ever persisting the
  raw token/credential. Unregistered product and invalid credential
  return an identical response (FR-010).
- New POST /v1/support/requests endpoint exercises the boundary
  end-to-end (ticket creation itself is a future feature).

Also:
- Fix docker-compose.test.yml's container_name collisions --
  discovered while testing this change concurrently is now covered
  by an app-level regression test (separate commit).
- Fix test:unit to scope to tests/unit only (it was running the
  entire tests/** glob including integration tests) -- this feature's
  new integration test makes real Prisma/Redis calls, unlike the
  prior instantiation-only checks, so the existing glob-scoping gap
  became actually harmful.
- Update Jenkinsfile with the new required credential.

Verified: full quality gate (typecheck/lint/format/architecture/
unit tests) passes; all of User Story 1's quickstart scenarios
manually verified end-to-end against a live server + Postgres +
Redis; the new integration test suite verified against a live
database (not run as part of `npm test`, matches existing
test:integration convention).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

prisma/seed/categories.seed.ts

@@ -5,7 +5,7 @@ export async function seedCategories(prisma: PrismaClient): Promise<void> {
   console.log('  -> Seeding baseline product categories...');
 
   const product = await prisma.product.findUnique({
-    where: { code: 'CORE_PLATFORM' },
+    where: { externalProductId: 'CORE_PLATFORM' },
   });
 
   if (!product) return;

prisma/seed/products.seed.ts

@@ -1,17 +1,17 @@
-import { PrismaClient, ProductStatus } from '@prisma/client';
+import { PrismaClient } from '@prisma/client';
 
 export async function seedProducts(prisma: PrismaClient): Promise<void> {
   // eslint-disable-next-line no-console
   console.log('  -> Seeding baseline products...');
 
   await prisma.product.upsert({
-    where: { code: 'CORE_PLATFORM' },
+    where: { externalProductId: 'CORE_PLATFORM' },
     update: {},
     create: {
-      code: 'CORE_PLATFORM',
+      externalProductId: 'CORE_PLATFORM',
       name: 'Core SupportHub Platform',
-      description: 'Main enterprise ticketing and support engine',
-      status: ProductStatus.ACTIVE,
+      supportEnabled: true,
+      status: 'active',
     },
   });
 }