docs: add rel-003, rel-004 releases and update CLI user scoping implementation

Release: REL-003_20260512 — CLI user scoping and local DB ops runbook

Requirements & Batches:
- BAT-003 (REQ-013): portfolio list --user required enforcement with owner filtering
- BAT-004 (REQ-014): portfolio create --user required enforcement with owner assignment
- BAT-007 (REQ-001/002/003): local DB validation runbook and baseline docs update

CLI Enhancements:
- Update user.py: add username-based user lookup (get_by_username)
- Add UserDetailResponse schema with service token listing
- Update list_service_tokens API in user_service.py
- Enhance user detail display with service token information
- Add service_token_count and service_token_names to user responses

Testing:
- Add comprehensive test coverage in test_cli.py for user commands
- Validate username-based lookup functionality

Release: REL-004_20260512 — Portfolio UUID migration and API UUID switch

Requirements & Batches:
- BAT-006 (REQ-016/017/018): portfolio UUID migration complete
- BAT-008 (REQ-019): baseline documentation update for UUID migration

Breaking Changes (REL-003):
- portfolio list requires --user <username> parameter
- portfolio create requires --user <username> parameter

Documentation:
- Create rel-003 and rel-004 release documents with rollout and rollback plans
- Update docs/releases/index.md with new releases
- Update README.md with CLI user scoping clarification
- Sync all release verification checklists and deployment notes

app/cli/core/utils.py

@@ -122,38 +122,41 @@ def print_portfolio_detail(console: Console, detail: PortfolioDetailResponse) ->
 
 
 def print_user_table(console: Console, users: list[UserResponse]) -> None:
-    table = Table(title="Users", expand=True)
-    table.add_column("ID", style="cyan", no_wrap=True)
-    table.add_column("Username", no_wrap=True)
-    table.add_column("Email")
-    table.add_column("Created At", no_wrap=True)
-    table.add_column("Updated At", no_wrap=True)
-    for user in users:
-        table.add_row(
-            user.id,
-            user.username,
-            user.email or "N/A",
-            user.created_at.isoformat(timespec="seconds") if user.created_at else "N/A",
-            user.updated_at.isoformat(timespec="seconds") if user.updated_at else "N/A",
-        )
-    console.print(table)
+    for i, user in enumerate(users, 1):
+        lines = [
+            f"username: {user.username}",
+            f"id: {user.id}",
+            f"email: {user.email or 'N/A'}",
+            f"permission: {user.permission}",
+            f"is_active: {'true' if user.is_active else 'false'}",
+            f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
+            f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
+        ]
+        for line in lines:
+            console.print(line)
+        if i < len(users):
+            console.print()
 
 
 def print_user_detail(console: Console, user: UserResponse) -> None:
-    console.print(
-        Panel.fit(
-            "\n".join(
-                [
-                    f"id: {user.id}",
-                    f"username: {user.username}",
-                    f"email: {user.email or 'N/A'}",
-                    f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
-                    f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
-                ]
-            ),
-            title="User",
-        )
-    )
+    lines = [
+        f"id: {user.id}",
+        f"username: {user.username}",
+        f"email: {user.email or 'N/A'}",
+        f"permission: {user.permission}",
+        f"is_active: {'true' if user.is_active else 'false'}",
+        f"last_login_at: {user.last_login_at.isoformat(timespec='seconds') if user.last_login_at else 'N/A'}",
+        f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
+        f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
+    ]
+    service_token_count = getattr(user, "service_token_count", None)
+    service_token_names = getattr(user, "service_token_names", None)
+    if service_token_count is not None and service_token_names is not None:
+        rendered_names = ", ".join(service_token_names) if service_token_names else "N/A"
+        lines.append(f"service_token_count: {service_token_count}")
+        lines.append(f"service_token_names: {rendered_names}")
+    for line in lines:
+        console.print(line)
 
 
 def print_service_token_list(console: Console, tokens: list[AuthTokenResponse]) -> None: