docs: add rel-003, rel-004 releases and update CLI user scoping implementation

Release: REL-003_20260512 — CLI user scoping and local DB ops runbook

Requirements & Batches:
- BAT-003 (REQ-013): portfolio list --user required enforcement with owner filtering
- BAT-004 (REQ-014): portfolio create --user required enforcement with owner assignment
- BAT-007 (REQ-001/002/003): local DB validation runbook and baseline docs update

CLI Enhancements:
- Update user.py: add username-based user lookup (get_by_username)
- Add UserDetailResponse schema with service token listing
- Update list_service_tokens API in user_service.py
- Enhance user detail display with service token information
- Add service_token_count and service_token_names to user responses

Testing:
- Add comprehensive test coverage in test_cli.py for user commands
- Validate username-based lookup functionality

Release: REL-004_20260512 — Portfolio UUID migration and API UUID switch

Requirements & Batches:
- BAT-006 (REQ-016/017/018): portfolio UUID migration complete
- BAT-008 (REQ-019): baseline documentation update for UUID migration

Breaking Changes (REL-003):
- portfolio list requires --user <username> parameter
- portfolio create requires --user <username> parameter

Documentation:
- Create rel-003 and rel-004 release documents with rollout and rollback plans
- Update docs/releases/index.md with new releases
- Update README.md with CLI user scoping clarification
- Sync all release verification checklists and deployment notes

tests/test_cli.py

@@ -753,8 +753,46 @@ def test_cli_user_list_renders_table() -> None:
     result = runner.invoke(runner.app, ["user", "list"])
 
     assert result.exit_code == 0
-    assert "Users" in result.stdout
-    assert "alice" in result.stdout
+    assert "username: alice" in result.stdout
+    assert "email: alice@example.com" in result.stdout
+    assert "╭" not in result.stdout
+    assert "│" not in result.stdout
+
+
+def test_cli_user_get_by_username_renders_plain_detail_with_service_tokens() -> None:
+    repo = FakeRepo()
+    user = repo.create_user("alice", email="alice@example.com", permission="admin", is_active=False)
+    user.last_login_at = datetime(2026, 5, 12, 0, 0, 0, tzinfo=timezone.utc)
+    repo.create_auth_token(
+        user.id,
+        name="svc-read",
+        token_hash=hash_token("raw-read-token"),
+        token_prefix=token_prefix("raw-read-token"),
+        permission="read",
+        token_type="service",
+    )
+    repo.create_auth_token(
+        user.id,
+        name="svc-write",
+        token_hash=hash_token("raw-write-token"),
+        token_prefix=token_prefix("raw-write-token"),
+        permission="trade-write",
+        token_type="service",
+    )
+    runner = build_runner(repo)
+
+    result = runner.invoke(runner.app, ["user", "get", "alice"])
+
+    assert result.exit_code == 0
+    assert "id: user-1" in result.stdout
+    assert "username: alice" in result.stdout
+    assert "permission: admin" in result.stdout
+    assert "is_active: false" in result.stdout
+    assert "last_login_at: 2026-05-12T00:00:00+00:00" in result.stdout
+    assert "service_token_count: 2" in result.stdout
+    assert "service_token_names: svc-read, svc-write" in result.stdout
+    assert "╭" not in result.stdout
+    assert "╰" not in result.stdout
 
 
 def test_cli_user_create_supports_json() -> None: