Fix tenant cache leak, dead DB pool/mock fallback, timezone month bounds, decimal money

[alpha-magic]

Summary

Full write-up in FINDINGS.md. Root causes fixed:

1. Cross-tenant cache leak — Redis key was revenue:{property_id}; property IDs are only unique per tenant (both tenants own prop-001). Key is now tenant- and period-scoped, and the cached payload's tenant is verified before serving.
2. Dashboard never read the database — the pool used non-existent settings.supabase_db_* fields and get_session was an async def used as a context manager; every request fell into a hard-coded mock table (prop-001 = 1000.00 for any tenant). Pool now uses DATABASE_URL, single shared pool, mock fallback removed → DB errors surface as 503.
3. Timezone-naive month bucketing — 2024-02-29 23:30 UTC is 1 March in Europe/Paris; month bounds are now evaluated in the property's timezone (AT TIME ZONE properties.timezone), and month/year are wired into the endpoint and UI.
4. Float money — float() on NUMERIC(10,3) plus a second rounding in the UI drifted cents. Sum in SQL, round once (ROUND_HALF_UP), serialise as string.
5. Hard-coded property list / fake trend badge in the frontend — replaced with a tenant-scoped /dashboard/properties endpoint; fabricated badge removed.
6. Hardening — no default_tenant fallback (403), tenant resolver reads the signed JWT claim and no longer defaults unknown users to tenant-a, X-Simulated-Tenant header removed, foreign property → 404.

Verification

• Sunset prop-001: 2250.00 / 4 (March 2024 in Paris: 2250.00; Feb: 0.00)
• Ocean prop-001: 0.00 / 0 (was showing Sunset's 1000.00 / 3)
• Redis keys: revenue:v2:{tenant}:{property}:{period}
• cd backend && python -m pytest -q → 9 passed

Loom

loom video