feat(02-01): UserModule, TenantModule, admin seed, and app.module wiring

- Create UserService with findByUsername (unscoped), create, update, deactivate, delete
- Create AdminSeedService that seeds Super-Admin from Docker ENV on bootstrap (D-05/D-07/D-13)
- Create TenantService with findAll, findById, create, update
- Create TenantMiddleware extracting tenantId from JWT with Super-Admin tenant switching (D-08/D-10)
- Wire PrismaModule, AuthModule, UserModule, TenantModule into AppModule
- Register JwtAuthGuard and RolesGuard as global APP_GUARD providers
- Apply TenantMiddleware to all routes via NestModule.configure
- Add @Public() decorator to HealthController for unauthenticated access

apps/api/src/user/admin-seed.service.ts

@@ -0,0 +1,68 @@
+import { Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import * as argon2 from 'argon2';
+import { PrismaService } from '../prisma/prisma.service';
+
+/**
+ * Creates the initial Super-Admin account from Docker ENV variables on first boot.
+ * Per D-05, D-07, D-13.
+ */
+@Injectable()
+export class AdminSeedService implements OnApplicationBootstrap {
+  private readonly logger = new Logger(AdminSeedService.name);
+
+  constructor(
+    private prisma: PrismaService,
+    private configService: ConfigService,
+  ) {}
+
+  async onApplicationBootstrap() {
+    const username = this.configService.get<string>('TESSERA_ADMIN_USER');
+    const email = this.configService.get<string>('TESSERA_ADMIN_EMAIL');
+    const password = this.configService.get<string>('TESSERA_ADMIN_PASSWORD');
+    const forceChange =
+      this.configService.get<string>('TESSERA_FORCE_CHANGE') === 'true';
+
+    if (!username || !email || !password) {
+      this.logger.log(
+        'Admin seed skipped: TESSERA_ADMIN_USER, TESSERA_ADMIN_EMAIL, or TESSERA_ADMIN_PASSWORD not set',
+      );
+      return;
+    }
+
+    // Check if admin already exists
+    const exists = await this.prisma.user.findUnique({
+      where: { username },
+    });
+
+    if (exists) {
+      this.logger.log(`Admin user "${username}" already exists, skipping seed`);
+      return;
+    }
+
+    // Upsert default tenant
+    const tenant = await this.prisma.tenant.upsert({
+      where: { slug: 'default' },
+      update: {},
+      create: { name: 'Default', slug: 'default' },
+    });
+
+    // Create Super-Admin user
+    const passwordHash = await argon2.hash(password);
+    await this.prisma.user.create({
+      data: {
+        username,
+        email,
+        passwordHash,
+        role: 'SUPER_ADMIN',
+        tenantId: tenant.id,
+        mustChangePassword: forceChange,
+        isActive: true,
+      },
+    });
+
+    this.logger.log(
+      `Admin user "${username}" seeded as SUPER_ADMIN in tenant "${tenant.slug}"`,
+    );
+  }
+}

apps/api/src/user/user.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { AdminSeedService } from './admin-seed.service';
+import { UserService } from './user.service';
+
+@Module({
+  providers: [UserService, AdminSeedService],
+  exports: [UserService],
+})
+export class UserModule {}

apps/api/src/user/user.service.ts

@@ -0,0 +1,90 @@
+import { Injectable } from '@nestjs/common';
+import * as argon2 from 'argon2';
+import { PrismaService } from '../prisma/prisma.service';
+
+@Injectable()
+export class UserService {
+  constructor(private prisma: PrismaService) {}
+
+  /**
+   * Find user by username. Uses UNSCOPED Prisma (not tenant-scoped)
+   * because login must work across all tenants.
+   */
+  async findByUsername(username: string) {
+    return this.prisma.user.findUnique({ where: { username } });
+  }
+
+  /**
+   * Find user by ID.
+   */
+  async findById(id: string) {
+    return this.prisma.user.findUnique({ where: { id } });
+  }
+
+  /**
+   * Create a new user with hashed password.
+   */
+  async create(data: {
+    username: string;
+    email: string;
+    password?: string;
+    displayName?: string;
+    role?: 'SUPER_ADMIN' | 'ADMIN' | 'USER';
+    tenantId: string;
+    mustChangePassword?: boolean;
+    ldapDn?: string;
+  }) {
+    const { password, ...rest } = data;
+    return this.prisma.user.create({
+      data: {
+        ...rest,
+        passwordHash: password ? await argon2.hash(password) : null,
+      },
+    });
+  }
+
+  /**
+   * Update user. If password is provided, hash it.
+   */
+  async update(
+    id: string,
+    data: {
+      username?: string;
+      email?: string;
+      password?: string;
+      displayName?: string;
+      role?: 'SUPER_ADMIN' | 'ADMIN' | 'USER';
+      isActive?: boolean;
+      mustChangePassword?: boolean;
+    },
+  ) {
+    const { password, ...rest } = data;
+    const updateData: any = { ...rest };
+
+    if (password) {
+      updateData.passwordHash = await argon2.hash(password);
+    }
+
+    return this.prisma.user.update({
+      where: { id },
+      data: updateData,
+    });
+  }
+
+  /**
+   * Deactivate a user (soft delete).
+   */
+  async deactivate(id: string) {
+    return this.prisma.user.update({
+      where: { id },
+      data: { isActive: false },
+    });
+  }
+
+  /**
+   * Hard delete a user.
+   */
+  async delete(id: string) {
+    return this.prisma.user.delete({ where: { id } });
+  }
+}