PLATFORM-SUPERADMIN-TENANT-LIFECYCLE-001: add tenant lifecycle administration

[NckNA]

Summary

Adds a platform-level tenant lifecycle foundation separate from clinic membership. Migration 0035 introduces active/disabled platform superadmins, lifecycle/effective-status enforcement, immutable subscription history, idempotent operations, transactional tenant creation with an initial clinic owner, final-owner protection, subscription changes, suspension, resume, expiry, archive, audit/activity and database mutation guards.

Current source of truth:

• PR: PLATFORM-SUPERADMIN-TENANT-LIFECYCLE-001: add tenant lifecycle administration #361
• Branch: feature/platform-superadmin-tenant-lifecycle-001
• Final PR HEAD: 326e266
• Final implementation HEAD: f8c8df0
• Changed files: 30
• Final CI: run #767, run ID 29355739081, SUCCESS on exact final PR HEAD

Platform routes use a separate non-clinical layout and safe DTOs. Platform administrators are not automatically tenant members and receive no automatic patient, clinical, financial or credential access.

Review-only foundation. Merge execution is outside this task. No custom permissions, billing provider, payment automation, support impersonation, physical tenant purge, cloud migration apply, HEP-V2 or unrelated amoCRM work is included.

Checks

• Final CI #767 (run ID 29355739081) on 326e266: SUCCESS
• validate / ESLint / full tests / build: SUCCESS
• Merge guard: SUCCESS
• SQL suites 0024–0035: PASS
• Required concurrency suites through 0035: PASS
• 0035 counters: 4 tenants, 6 history rows, 1 replay, 6 conflicts, 14 audit, 14 activity, 0 deadlocks
• Invariants: ownerless active 0, missing lifecycle 0, duplicate current periods 0, archived access 0, cross-tenant mutations 0, audit mismatch 0
• Full Vitest: 122 files / 1206 tests PASS
• Authenticated browser role matrix: 6/6 PASS
• Lifecycle browser smoke: create, suspend, resume, expire, extend, owner recovery, archive and multi-tenant switch PASS
• Network/static proof: controlled RPC writes only; direct platform table writes, clinical/financial payloads, service-role exposure, provider/amoCRM/message calls all 0
• Final local reset through migration 0035: PASS; task QA users/platform admins/operations 0; task port closed

Limitations

• Legacy Stripe-shaped subscriptions remain for compatibility; lifecycle authority is tenant_lifecycle plus tenant_subscription_periods.
• Two pre-existing local demo tenant identities remain provisioning after reset with zero memberships.
• Effective suspension/expiry enforcement requires no cron; persisted reconciliation may be added later.
• No tenant hard-delete product operation is exposed; postgres-only local fixture cleanup remains test-scoped.