[amar-python]

Records the Milestone 2 backend work in docs/VCRM.md and the README. Docs only.

• BR-36: ❌ Not started → ⚠️ Partial. The row names the merged PRs (feat(auth): control schema, local accounts and sign-in sessions (M2a, #92) #98, feat(tenancy): route each signed-in request to its tenant's schema (M2b, #93) #100, feat(auth): enforce the role matrix on every data route (M2c, #94) #101, feat(auth): lock accounts after repeated failed sign-ins (#102) #103, feat(tenancy): give each tenant its own T&E tables (#99) #104, feat(auth): OIDC sign-in against a deployment-controlled IdP (#95) #105) and their tests, each of which failed with its control removed. Frontend sign-in (M2e: frontend sign-in and tenant-scoped session (BR-36) #96) is still open.
• BR-28: stays Partial. Adds the evidence that duplicate detection is per tenant for signed-in requests (feat(tenancy): route each signed-in request to its tenant's schema (M2b, #93) #100).
• Totals: partial goes from 10 to 11 and not started from 5 to 4. The headline is unchanged at 19 of 37 verified.
• README: the authentication limitation now says per-user sign-in exists in the API, while the browser stays on the shared key until M2e: frontend sign-in and tenant-scoped session (BR-36) #96.

Checks: DB-free pytest 128 passed.

---

Generated by Claude Code